> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-runtime-security/serverless-runtime-issues.md).

# Serverless runtime issues

Investigate runtime security issues detected in serverless functions.

You can view all serverless function issues detected by an agent and generated from policy violations under **Issues** (under Cases & Issues) inventories.

Every policy violation creates an issue per type:

* Process activity - enables specifying specific allowed list processes, blocking all processes except the main process and detecting crypto mining attempts.
* Network activity - enables monitoring and enforcement of DNS resolutions, inbound and outbound network connections.
* Filesystem activity - enables defining specific paths in an allowed or denied list.

Additional issues from specific policy violation are raised, which include the same cloud provider, region, runtime, function name, function version, issue name and issue description, will be suppressed.

The **Issues** page includes the following information indicating unique serverless function issues raised by agents:

| Field                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Domain                    | For serverless, this is set to **Security**.                                                                                                                                                                                                                                                                                                                                                                                                              |
| Category                  | For serverless, this is set to **Cloud**.                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Name                      | <p>For serverless, the relevant issue name appears:</p><ul><li>Serverless function Network Policy violation for outbound ports</li><li>Serverless function Network Policy violation for listening ports</li><li>Serverless function Network Policy violation for DNS</li><li>Serverless function Network Policy violation for IPs</li><li>Serverless function File system Policy violation</li><li>Serverless function Process Policy violation</li></ul> |
| Detection method          | For serverless, this is set to **XDR agent**.                                                                                                                                                                                                                                                                                                                                                                                                             |
| Severity                  | For serverless, this is always set to **High**.                                                                                                                                                                                                                                                                                                                                                                                                           |
| Cloud Function Runtime    | <ul><li>Python</li><li>Node.JS</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Cloud Function Request ID | Instance id from the cloud provider.                                                                                                                                                                                                                                                                                                                                                                                                                      |

{% hint style="info" %}

### Note

Issues triggered within 24 hours, sharing the same name and description, will be aggregated into cases along with issues from the same function per execution.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-runtime-security/serverless-runtime-issues.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.