> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset.md).

# Tools as an asset

Supply Chain: Gain full visibility by tracking detected tools in your environment and cross-referencing them against a catalog of Cortex-recognized, trusted technologies.

The Software supply chain tool inventory provides comprehensive visibility into the tools, services, and third-party integrations that operate across your software development and delivery processes. It includes two complementary inventories:

* [Supply Chain Tools](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset/supply-chain-tools.md): Lists tools and their associated risk factors detected in your environment
* [Supply Chain Catalog](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset/supply-chain-catalog.md): Cortex Cloud's centralized registry of recognized supply-chain tools and their associated risk factors

Together, these inventories allow you to assess tool usage, coverage, and security posture—identifying unused, vulnerable, or unapproved tools before they expand your attack surface.

## Execution environments

Cortex Cloud supports these Supply Chain Tool execution environments:

* **Third party pipelines**: Third-party plugins integrated with Cortex Cloud, provide visibility into installations, locations, and CVE vulnerabilities within your pipeline environment. This allows for prioritized remediation, effectively reducing your attack surface by identifying and removing unused or vulnerable plugins.

  Supported pipeline environments include:

  * **GitHub Actions**
  * **Jenkins plugins**
  * **CircleCI Orbs**
  * **Azure Extensions**

  Additionally, these pipelines often incorporate third-party executables into their workflows. Cortex Cloud offers enhanced visibility into these third-party services, transforming unreadable data into actionable insights for improved security posture.
* **VCS third parties**: **VCS Apps**. Third-party applications and webhooks in your version control system. This enables removal of unused assets, management of permissions, and adherence to the principle of least privilege
* **Executables**: Standalone programs or scripts executed within your CI/CD pipelines. These may include custom scripts, third-party command-line tools, or other executable files. The inventory provides insights into their usage, deployment locations, and potential security risks
* **Remote Scripts (URL)**. Executable scripts fetched from a remote URL during pipeline execution. The inventory provides insights into their origin, usage, and potential security risks, addressing the unique challenges of untrusted remote code
* **Webhooks**: Automated, event-driven communications that trigger actions across your CI/CD pipeline and integrated services. Cortex Cloud provides an inventory of these webhooks, enabling you to assess their usage, coverage, and potential security risks

## Tool status

Tools are categorized by status: **Approved**, **Pending Review**, or **Rejected** (but still in use). When initially detected, tools are assigned a **Pending Review** status by default, requiring further action to change the status to **Approved** or **Rejected**. **Rejected** does not mean the tool is not in use. It allows application security practitioners and DevOpsSec personnel to search for and remove these tools as needed.

You can modify the tool status by right-clicking on a tool in both Supply Chain Tool and Supply Chain Catalog inventories:

* In the inventory table, **right-click on a tool** → **Change Status** → **select a status**
* From the **Overview** tab on the Supply Chain side-panel.
  * Initial selection: Select a status from the available options
  * When modifying a previous selection: Select **Edit** → **select a status**

For information about changing a tool status, refer to [Overview](#UUID-1f6447d5-765b-b3b6-a766-e24bf6ddd5ce_section-idm23482364300859)

## Understand the inventories

* Use **Supply Chain Tools** to view and manage tools detected in your environment, review usage, and prioritize remediation
* Use the **Supply Chain Catalog** to cross-reference detected tools against Cortex Cloud-supported ones, identify coverage gaps, and evaluate risk before integrating new tools or replacing existing ones

{% hint style="info" %}

### Note

Although attributes are identical across inventories, their values for the same tool can differ, most commonly in **Risk Factors** and **Type**. This is because the inventory reflects your live environment, which may include different versions or configurations than the catalog—for example, a package may not have been upgraded or may be deployed differently.
{% endhint %}

## Active tools

The **Active tools** (Customer's environment) provides detailed information about individual tools, including deployments, areas of non-use, and functionality detected in your SDLC. This data allows you to assess tool usage, coverage, and potential security risks.

## Use cases

* **Tool visibility:** Gain visibility into all tools used across CI/CD pipelines and VCSs
* **Third-Party tools:** Discover and monitor all external tools (webhooks, executables, apps, plugins) integrated into your CI/CD pipelines and VCSs
* **Detailed Tool insights:** Access detailed information on each tool (creator, risk factors such as deprecation or low usage, usage evidence, first seen date, category) to evaluate approval status and assess risk
* **Rejected Tool Monitoring:** Manage tool approval status by approving or rejecting tools found in pipelines/VCSs, identifying non-compliant usage
* **Usage:** View tool usage indicators by category across pipelines/VCSs for management reporting internal as well as external usage


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.