Reference: Repositories asset attributes
This reference lists the attributes of the Repositories asset table in the Cortex Cloud unified asset inventory, divided by default column visibility.
Table 1 lists the attributes displayed as default exposed columns when the table first opens.
Table 2 lists hidden attributes available through the column picker but not displayed by default.
Navigate to the table at Assets > All Assets > Code > Repositories.
Note: The attribute names in this reference are the labels displayed in the console. The underlying XDM field names are required when you query repository assets through XQL or through the API. The console labels and the XDM field names are not interchangeable.
Table 1: Attributes displayed by default
The following nine attributes are displayed as columns when the Repositories table first opens, or after you reset the table to its default state.
Repository Name
The name of the repository, qualified by its organization or group. The primary identifying column.
Repository Organization
The VCS organization, group, or workspace that contains the repository.
Provider
The VCS platform that hosts the repository, such as GitHub, GitLab, GitLab Self-Managed, Bitbucket, or Azure Repos.
Scanned Branches
The branches configured for scanning. A repository whose primary branch is absent from this list is being scanned somewhere other than the branch that ships to production.
Repository labels
Labels applied to the repository, drawn from the VCS provider and from platform enrichment.
Is repository archived
Whether the repository is archived in the VCS provider. Displayed as Yes or No.
Business Application Names
The business applications associated with the repository. This attribute is shared across the platform and is the primary basis for routing work by ownership.
First observed
The timestamp when Cortex Cloud first observed the repository.
Observation time
The timestamp of the most recent observation of the repository.
The default column set is built for triage, not discovery. Unlike most asset tables, the default view here leads with operational signal rather than classification: Scanned Branches and Is repository archived together answer whether a repository is being scanned and whether scanning it still matters, and Business Application Names answers who owns the result. Every classification attribute — Asset Id, Asset class, Asset category — is hidden, because those attributes hold the same value on every row of this table and differentiate nothing within it.
Caution: First observed and Observation time both describe when the platform saw the repository, not when the repository last changed and not when it was last scanned. A recent Observation time confirms the asset is still being inventoried; it does not confirm that scanners ran or that the code is active. To assess development activity, add Repository last commit from Table 2.
Table 2: Attributes available through the column picker
The following nineteen attributes are available through the column picker and are not displayed by default. Select the column picker icon to add any of these attributes as a column.
Asset identity and classification
Asset Id
The unique internal identifier of the repository asset. Required when you call the repository API endpoints, which are keyed by asset identifier.
Asset class
The asset class classification. Always Code for a repository.
Asset category
The asset category classification. Always Repository for a repository.
VCS Organization Asset Id
The asset identifier of the parent VCS Organization asset. Use this attribute to join repositories to their organization-level posture.
Repository properties
Repository primary branch
The primary branch of the repository, such as main or master. Compare against Scanned Branches to detect scan coverage that misses the shipping branch.
Repository size in mb
The size of the repository in megabytes.
Repository Visibility Configuration
The visibility state of the repository in the VCS provider, such as Public, Private, or Internal. The primary attribute for identifying externally exposed source code.
Repository owners
The owners recorded for the repository in the VCS provider.
Repository technologies
The programming languages and technologies detected in the repository.
Repository activity
Repository last commit
The timestamp of the most recent commit. The reliable indicator of whether a repository is actively developed or dormant.
Repository tag metadata
Tag information collected from the repository.
Repository issues metadata
Issue-tracker information collected from the repository in the VCS provider. This attribute describes VCS provider issues, not Cortex Cloud security issues.
Repository releases metadata
Release information collected from the repository.
Repository forks
Fork information for the repository.
Context and relationships
Development Cycle Stages
The software development lifecycle stages the repository participates in.
Applications Ids
The identifiers of the applications associated with the repository. The identifier counterpart to the Business Application Names column shown by default.
Attack ID
The identifier of an attack path associated with the repository.
Attack Name
The name of an attack path associated with the repository.
Diagnostic
Normalized fields By Source
The raw normalized field values grouped by the source that supplied them. A diagnostic attribute for tracing where a given value originated when sources disagree.
Recommended column additions
The default view does not carry enough information to prioritize repositories. Add the following columns to convert the inventory into an assessment surface.
Repository Visibility Configuration
Which repositories are public, and therefore expose source code and any secrets committed to it?
Repository last commit
Which repositories are actively developed, and which are dormant but not archived?
Repository primary branch
Does scan coverage in Scanned Branches actually include the branch that ships?
Repository technologies
Which repositories use technologies that carry known supply chain or ecosystem risk?
Repository owners
Who do I route a finding to when no business application is mapped?
A high-value combination. Filter Repository Visibility Configuration to Public, filter Is repository archived to No, and sort by Repository last commit descending. The result is the set of externally exposed, actively developed repositories — the population where a new finding carries the highest urgency.
Last updated
Was this helpful?