> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/how-the-c2c-engine-works.md).

# How the C2C engine works

Cortex Cloud maps and maintains lineage using a specialized correlation engine. Full coverage is achieved when the system can resolve the chain: **Repository → Pipeline → Image → (optional Registry) → Runtime resources**.

The engine relies on three primary mechanisms:

* **Asset Lineage graph**: A queryable graph database populated by ingesting metadata from Version Control Systems (VCS), CI/CD pipelines, runtime scanners, and AI-powered analysis of build logs to extract deterministic links\
  NOTE: For the complete list of supported providers and build tools per component (VCS, CI/CD, containers, VM images, IaC) that are required to build the asset lineage, refer to [Reference A: Supported integrations and asset stages](/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/reference-a-supported-integrations-and-asset-stages.md).
* **Infrastructure-as-Code (IaC) Traceability (YOR)**: Cortex Cloud relies on **YOR tags** to bridge the gap between your static IaC templates (like Terraform or CloudFormation) and the dynamic, live cloud assets they create. During a scan, the Cortex Cloud tagging bot automatically applies a unique YOR trace tag to your IaC resources. Cortex Cloud uses these specific tags to build your Asset Lineage Graph, drawing a direct link from the source code template to the exact cloud asset it provisioned (IaC Resource → Cloud Asset). If YOR tags are missing, the lineage link breaks. To fix this, the system will prompt you to visit the YOR website to trigger the tagging process, ensuring you maintain full visibility into your infrastructure
* **Drift detection logic:** Correlates the declared state from VCS with the runtime state from CSPM integrations, using Git as the single source of truth. A runtime change is flagged as drift only when it violates a security policy that is not violated in the source code, a deliberate design choice that keeps the signal restricted to security-relevant regressions rather than every operational change made outside of Git


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/how-the-c2c-engine-works.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.