> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/all-cloud-assets/asset-hierarchy.md).

# Asset hierarchy

The asset inventory displays the full cloud hierarchy path for assets across Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud Infrastructure, allowing you to use **Hierarchy Path** to filter, sort, search, or build asset groups and enforce Scope-Based Access Control (SBAC).

{% hint style="info" %}
**NOTE**

Asset hierarchy data is only available if you onboard your cloud environment using organization-wide or root-level onboarding; it does not apply to environments configured with single-account or individual onboarding.

If you choose to exclude specific organizational units during onboarding, asset hierarchy paths may be incomplete in the asset inventory.
{% endhint %}

The asset inventory integrates cloud provider hierarchies, ranging from root organizations to specific folders and projects, to provide structural context regarding where a resource resides.

**Asset detail enhancements**

When an asset is discovered, its profile includes three structural attributes to define its location in the cloud hierarchy:

* Realm (Account/Project)
* Organization
* Full Path: Captures all intermediate levels, such as folders and sub-folders, specific to the provider's logic.

These details update when a resource is moved within the cloud provider and display within the asset table.

**Query and Filtering Capabilities**

You can navigate the cloud structure using the **Hierarchy Path** filter in the asset inventory to search for resources under any path in the hierarchy.

* The filter operator logic supports autocomplete and multi-select functionality, displaying the hierarchy in ascending order.
* The filter value displays both the path and the unique ID. For example, GCP Org / Department X (13243141). The ID is for the last item in the path.

You can search by the name or ID of the objects within the autocomplete. For example, you can search by the cloud ID of the organization.

**Asset Groups and Scope-Based Access Control (SBAC)**

You can integrate the hierarchy filtering into Asset Groups to allow for automated grouping by business unit or environment.

This hierarchy data is exposed to Scope-Based Access Control (SBAC) to define permissions based on organizational branches. This allows administrators to configure access so that a user scoped only to **Folder A** cannot see assets residing in **Folder B**, despite being in the same cloud account. If you give access to a parent folder, the user also has access to all child folders.

\
**API Support**

Users can retrieve the full path in the **GET Assets** API, query assets by their hierarchy path using the **Assets API**, and create asset groups by their hierarchy path using the **Asset Groups** API.

\
**Azure resource group visibility**

You can filter, search, and audit your multi-cloud inventory by Azure resource group fields captured within the asset inventory. This resource metadata allows you to track cloud assets by their precise deployment boundaries, build custom asset groups, and enforce Scope-Based Access Control (SBAC).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/all-cloud-assets/asset-hierarchy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.