> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-runtime-security/serverless-runtime-issues.md).

# Serverless runtime issues

You can view all serverless function issues detected by an agent and generated from policy violations under **Issues** (under Cases & Issues) inventories.

Every policy violation creates an issue per type:

* Process activity - enables specifying specific allowed list processes, blocking all processes except the main process and detecting crypto mining attempts.
* Network activity - enables monitoring and enforcement of DNS resolutions, inbound and outbound network connections.
* Filesystem activity - enables defining specific paths in an allowed or denied list.

Additional issues from specific policy violation are raised, which include the same cloud provider, region, runtime, function name, function version, issue name and issue description, will be suppressed.

The **Issues** page includes the following information indicating unique serverless function issues raised by agents:

| Field                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Domain                    | For serverless, this is set to **Security**.                                                                                                                                                                                                                                                                                                                                                                                                              |
| Category                  | For serverless, this is set to **Cloud**.                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Name                      | <p>For serverless, the relevant issue name appears:</p><ul><li>Serverless function Network Policy violation for outbound ports</li><li>Serverless function Network Policy violation for listening ports</li><li>Serverless function Network Policy violation for DNS</li><li>Serverless function Network Policy violation for IPs</li><li>Serverless function File system Policy violation</li><li>Serverless function Process Policy violation</li></ul> |
| Detection method          | For serverless, this is set to **XDR agent**.                                                                                                                                                                                                                                                                                                                                                                                                             |
| Severity                  | For serverless, this is always set to **High**.                                                                                                                                                                                                                                                                                                                                                                                                           |
| Cloud Function Runtime    | <ul><li>Python</li><li>Node.JS</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Cloud Function Request ID | Instance id from the cloud provider.                                                                                                                                                                                                                                                                                                                                                                                                                      |

{% hint style="info" %}

### Note

Issues triggered within 24 hours, sharing the same name and description, will be aggregated into cases along with issues from the same function per execution.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-runtime-security/serverless-runtime-issues.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.