> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset/supply-chain-tools.md). # Supply Chain tools The **Supply Chain Tools** inventory table provides a detailed list of your organization's CI/CD pipeline tools and VCS Apps, allowing you to view and manage your organization's supply chain tools from a single, centralized location. You can review tool usage, third-party integrations, and risk assessments, including creator information, usage evidence, and category details. Additionally, you can filter tools by status (approved, rejected, uncategorized) and category, search for specific tools, and identify top risks to ensure policy adherence and prioritize remediation. ## How to access Supply Chain Tools To access Supply Chain Tools, select **Modules** → **Application Security** → **Supply Chain Tools** (under **3rd Party Tools**). ## Supply Chain tools inventory The inventory table describes the exposed Supply Chain tool properties. You can view additional properties through the **Table Settings Menu**. | Property/ Attribute | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | The name of the Supply Chain tool | | Risk Factors |

Risk factors associated with the tool, as assessed by Cortex Cloud, help you identify and prioritize potential risks for tools and components based on their likely impact and exploitability. Values include Archived, Not verified, Unsecured URL and Outdated Version.

For tools in your environment, risk factors are specific to the exact version you have, whereas catalog risk factors reflect the tool’s general profile. To understand the specific reasoning behind a risk factor, hover over it to view a detailed explanation

| | Status | The tool status. Values: Approved, Pending, Rejected | | Usage | The amount of CI/CD pipelines in which the tool was used. Includes a link which opens the location in which the tool is used | | Type | The type of tool | | Category | The category associated with the tool, such as Version Control System (VCS), Continuous Integration (CI) Servers and Build Automation Tools | ### Expanded Supply Chain tool information When you click a tool's entry in the inventory table, a side card will open to display detailed information. The information is organized into three tabs: the **Overview** tab, which provides a summary of the tool's key details and is the default view; the **Vulnerabilities** tab, which lists any associated security vulnerabilities (CVEs); and the **Actions** tab, which outlines available mitigation options for the tool. {% tabs %} {% tab title="Overview" %} The **Overview** tab includes these details: * **Name**: The name of the tool * **Description**: A description of the tool usage and a link to its third-party origin, such as a public repository, documentation portal, or the vendor's official website * **PAN insights**: Cortex Cloud mitigation recommendations based on risk factors to address relevant supply-chain threats * **Timestamp**: When the tool was initially detected * **Category**: The tool type, such as code scanning and analytics * **Usage**: The amount of assets using this tool * **Status**: The current status of the tool. Values include **Approved**, **Pending Review**, **Rejected**. You can manually override the system-assigned status * **Approve** / **Reject**: Approve or reject the tool.

Note

AppSec Admin user permissions are required to perform these actions.

* **Execution environments**: A list of execution environments associated with the tool. Details include: name, the number of assets using the tool and the scan type {% endtab %} {% tab title="Usage" %} The **Usage** tab provides a list of the execution environments associated with the tool. Details include * The asset name in which the tool runs (such as a pipeline). Selecting the name opens the asset in a side-car without having to navigate to the dedicated **Assets** page * The type of asset, such as CI/CD pipeline, CI/CD instance, or Organization (for VCS Apps) * Evidence of the tool in the environment - the location of the file containing the tool * When the tool was initially detected. {% endtab %} {% tab title="Vulnerabilities" %} The **Vulnerabilities** tab is displayed whenever one or more tools has a risk factor that is a result of a Common Vulnerability and Exposure (CVE). This tab provides a consolidated list of all CVEs impacting the tools. The table includes these properties: * **Name**. The unique identifier for the CVE entry. For example, CVE-2023-25764. This name is a clickable link that directs you to a detailed report on the vulnerability from a public database * **CVSS Score**. The numerical score assigned to the vulnerability based on the Common Vulnerability Scoring System (CVSS). This score indicates the severity of the vulnerability, with a higher number representing a greater risk * **Asset**: The specific asset affected by the CVE {% endtab %} {% endtabs %} ## Actions ### Comments Select the **Comments** icon in the side-panel to add comments directly to catalog items, enabling collaboration and internal notes between security and development teams regarding component usage, justification, or deprecation status. ### Export tool information To export catalog information, select the **Download** icon in the main inventory table. The export option is not available in the side panel. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset/supply-chain-tools.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.