> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/investigate-and-remediate-vulnerabilities.md). # Investigate and remediate vulnerabilities Cortex XSIAM provides several ways to view and track vulnerability data so you can monitor, investigate, and remediate vulnerabilities in your environment. ## **View all Vulnerabilities** The **Vulnerabilities** page displays all your vulnerabilities grouped by CVE or other vulnerability ID. This view shows you how prevalent each vulnerability is in your environment. The **Vulnerabilities** page includes key information about each vulnerability, with links to the related lists of instances (also called findings), related issues, and impacted assets. Go to **Home > Modules > Vulnerability & Exposure Management >** **Vulnerabilities**. ## **View vulnerability issues** The **Vulnerability Issues** page displays all vulnerability issues along with critical vulnerability intelligence and context so you can assign an issue to an owner, investigate, remediate, and track progress. Follow the steps below to view Vulnerability Issues and investigate them further: 1. Go to **Home > Modules > Vulnerability & Exposure Management > Vulnerability Issues**. Click on an issue in the table to display the issue details panel. You can also optionally generate a .tsv file export of the data if required from the Vulnerability Issues page. 2. The issue details side panel provides the following investigation and remediation options: * The **Overview** tab on the Vulnerability Issues panel captures all the relevant details to further investigate the vulnerability including **Summary**, **Details, Linked Cases, and Evidence**. Select Evidence to view the technical context necessary for effective action and remediation. Here you can view: * At the top you can view the compromised asset or packages that led to Vulnerability creation. * Vulnerability Details Highlights are provided to indicate if a fix is available. * Vulnerability Summary provides granular details regarding impacted scores such as CVSS and EPSS. * Vulnerability Asset & Code Details includes additional details regarding Asset Location, Package in Use, and Findings Sources. * In addition, you can further isolate the vulnerability by examining the **Exposure Graph**. Review the Exposure Graph to understand where the vulnerability originates and how it impacts Findings and Assets. Select **More Info** to view granular details about each of the impacted assets. Use the graph to investigate relationships between K8s Namespaces, Clusters, Workloads, and Container Images. Note that Cortex Attack Surface Management and Cortex Network Scanner do not have graphs associated with them. ![exposure-graph.png](/files/t8WxD9aPcSjVHYjxJTQy) * Click **Resolution** to view remediation options. Here you can select Work Plan if you already have an automation Playbook in place. Learn more about [Playbooks](/cortex-xsiam/configure-cortex-xsiam/automations/autonomous-playbooks.md). Select **Remediation Guidance** to view manual steps to resolve the issue. Manual steps include: * General and LLM generated Step-by-Step instructions to remediate the issue. * Workarounds are only included for Exposure Management issues. * Select **Risk Details** to view the Cortex Vulnerability Risk Score information as well as any existing **Compensating Controls** in place. * Click **War Room** for real-time investigation capabilities powered by ChatOps. In the War Room you can capture context from different sources and collaborate and execute remote actions across integrated products. * **Work Plan** is available when you select an autonomous playbook in an issue's resolution tab. This view presents only the executed key tasks and their defined outputs, providing a focused view of resolution actions. ## **View All Vulnerability Findings** A vulnerability finding is a specific instance of a vulnerability that was discovered in your environment. The **All Vulnerability Findings** page lists every instance of every vulnerability that was discovered in your environment. Go to **Vulnerabilities** and click the **All Vulnerability Findings** button. ## **View vulnerable assets** The **Vulnerable Assets** page displays all assets with a vulnerability finding. This view enables you to prioritize vulnerabilities by asset and asset type and focus on assets most critical to fix. The **Vulnerable Assets** list provides links to the findings and issues for each asset. Click on an asset in the table to see the asset details. Go to **Home > Modules > Vulnerability & Exposure Management >** **Vulnerable Assets**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/investigate-and-remediate-vulnerabilities.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.