> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-tab-asset-level.md). # C2C tab (asset level) The Code-to-Cloud tab is displayed on the side panel of individual assets and provides the asset lineage as a graph. The tab can be reached from an asset in the UAI or from dedicated Cortex Cloud asset inventories, such as Repository and Kubernetes Resources, and maps the asset to its upstream source and downstream runtime deployments. When the lineage is incomplete, the tab links directly to the onboarding step that completes the trace. ## Prerequisites | Prerequisite | Description | | -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Cortex Cloud license** | An active Cortex Cloud license with ASPM entitlements. | | **Asset in a supported category** | The asset must be managed by IaC or produced as an Artifact. Approximately 30 asset types show the tab, including Repository, IaC Resource, Software Package, and CI/CD Pipeline. | | **Data sources onboarded** | For a complete trace, the relevant VCS, CI/CD, registry, and cloud data sources must be onboarded. | | **YOR tagging (Infrastructure trace)** | Infrastructure lineage requires IaC resources and runtime cloud assets to carry a YOR trace tag. | | **`dataSources` write permission** | Triggering an onboarding call-to-action from the empty state requires write permission on data sources. Viewers without this permission see the tab and trace state but no onboarding actions. | ## The phase model The tab buckets an asset's trace into SDLC phases that depend on asset class: * **Artifact** assets (Repository, Software Package, CI/CD Pipeline) use Code → Build → Deploy → Runtime * **IaC / Cloud** assets use IaC → Cloud * Four node types: **API Gateway, Kubernetes Node, Registry Image, and Runtime Image**, render as graph-only nodes. They have no side panel or Code-to-Cloud tab. They still participate in assets' lineage ### The three display modes | Display mode | What the reader sees | Use when | | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | **Empty state** | The Complete Your Traceability panel, phase icons, a dynamic description, a call-to-action button, and a Last updated timestamp. No graph | The asset has only one phase of trace data. Action is required to establish traceability | | **Graph with inline notification (partial)** | The lineage graph plus an inline notification that a portion of the trace is incomplete | Some phases are connected and at least one is not. Action closes the remaining gap | | **Graph only (full)** | The lineage graph with no notification | The asset has a complete trace across all applicable phases. No action is required | ## **Understand and investigate Code-to-Cloud** 1. Open the asset side panel from the relevant inventory. The side panel opens with its default tab selected. 2. Select the **Code to Cloud** tab. The tab renders in one of the three display modes. **If the tab is not present:** The asset is neither IaC-managed nor artifact-derived, or the asset is a graph-only node type. 3. Read the display mode and, in the empty or partial state, review the **Last updated** timestamp. 4. Select the call-to-action button to start the onboarding step that closes the gap. NOTE: For the complete call-to-action routing table by asset type, refer to [Page Reference F: Call-to-action routing by asset type1](/application-security/code-to-cloud/code-to-cloud/references/page-reference-f-call-to-action-routing-by-asset-type1.md). * **If you lack `dataSources` write permission:** The call-to-action does not appear. A **Permission Required** message and a viewer-only description are shown instead. **Result:** The reader knows whether the asset is fully, partially, or minimally traced, and when a gap exists has either triggered the onboarding action that closes the gap or identified the permission required to do so. > **Note:** Urgency signals for findings on the asset depend on the trace shown in the Code-to-Cloud tab. When the tab shows an empty or partial state, deployment-context Urgency signals may be incomplete or "Not Applicable" until the trace is completed. **Graph behavior:** The graph renders code-side nodes on the left and cloud-side nodes on the right (code-left / cloud-right), always reading in the same direction. The focused asset is highlighted among its lineage neighbors, and IaC Resource / Software Package nodes render as adjacent nodes reflecting their lineage position. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-tab-asset-level.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.