Supply Chain tools
The Supply Chain Tools inventory table provides a detailed list of your organization's CI/CD pipeline tools and VCS Apps, allowing you to view and manage your organization's supply chain tools from a single, centralized location. You can review tool usage, third-party integrations, and risk assessments, including creator information, usage evidence, and category details. Additionally, you can filter tools by status (approved, rejected, uncategorized) and category, search for specific tools, and identify top risks to ensure policy adherence and prioritize remediation.
How to access Supply Chain Tools
To access Supply Chain Tools, select Modules → Application Security → Supply Chain Tools (under 3rd Party Tools).
Supply Chain tools inventory
The inventory table describes the exposed Supply Chain tool properties. You can view additional properties through the Table Settings Menu.
Name
The name of the Supply Chain tool
Risk Factors
Risk factors associated with the tool, as assessed by Cortex Cloud, help you identify and prioritize potential risks for tools and components based on their likely impact and exploitability. Values include Archived, Not verified, Unsecured URL and Outdated Version.
For tools in your environment, risk factors are specific to the exact version you have, whereas catalog risk factors reflect the tool’s general profile. To understand the specific reasoning behind a risk factor, hover over it to view a detailed explanation
Status
The tool status. Values: Approved, Pending, Rejected
Usage
The amount of CI/CD pipelines in which the tool was used. Includes a link which opens the location in which the tool is used
Type
The type of tool
Category
The category associated with the tool, such as Version Control System (VCS), Continuous Integration (CI) Servers and Build Automation Tools
Expanded Supply Chain tool information
When you click a tool's entry in the inventory table, a side card will open to display detailed information. The information is organized into three tabs: the Overview tab, which provides a summary of the tool's key details and is the default view; the Vulnerabilities tab, which lists any associated security vulnerabilities (CVEs); and the Actions tab, which outlines available mitigation options for the tool.
The Overview tab includes these details:
Name: The name of the tool
Description: A description of the tool usage and a link to its third-party origin, such as a public repository, documentation portal, or the vendor's official website
PAN insights: Cortex Cloud mitigation recommendations based on risk factors to address relevant supply-chain threats
Timestamp: When the tool was initially detected
Category: The tool type, such as code scanning and analytics
Usage: The amount of assets using this tool
Status: The current status of the tool. Values include Approved, Pending Review, Rejected. You can manually override the system-assigned status
Execution environments: A list of execution environments associated with the tool. Details include: name, the number of assets using the tool and the scan type
The Usage tab provides a list of the execution environments associated with the tool. Details include
The asset name in which the tool runs (such as a pipeline). Selecting the name opens the asset in a side-car without having to navigate to the dedicated Assets page
The type of asset, such as CI/CD pipeline, CI/CD instance, or Organization (for VCS Apps)
Evidence of the tool in the environment - the location of the file containing the tool
When the tool was initially detected.
The Vulnerabilities tab is displayed whenever one or more tools has a risk factor that is a result of a Common Vulnerability and Exposure (CVE). This tab provides a consolidated list of all CVEs impacting the tools. The table includes these properties:
Name. The unique identifier for the CVE entry. For example, CVE-2023-25764. This name is a clickable link that directs you to a detailed report on the vulnerability from a public database
CVSS Score. The numerical score assigned to the vulnerability based on the Common Vulnerability Scoring System (CVSS). This score indicates the severity of the vulnerability, with a higher number representing a greater risk
Asset: The specific asset affected by the CVE
Actions
Comments
Select the Comments icon in the side-panel to add comments directly to catalog items, enabling collaboration and internal notes between security and development teams regarding component usage, justification, or deprecation status.
Export tool information
To export catalog information, select the Download icon in the main inventory table. The export option is not available in the side panel.
Last updated
Was this helpful?