> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets.md). # Compute assets **Compute assets** The Compute Inventory provides a detailed overview of your compute resources, including virtual machines, containers, serverless functions, Kubernetes clusters, general devices, and other compute assets across your environment. **Compute categories** Navigate to **Inventory** → **All Assets** → **Compute** to view an aggregated summary or to filter your inventory by the following specific categories: | Asset category | Description | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | All Compute Assets | An aggregated summary view of all your compute resources. | | CaaS Resources | Provides full inventory visibility for managed container services across AWS, GCP, and Azure. For AWS container services, related issues are displayed. The dedicated dashboard features interactive widgets summarizing the distribution by cloud provider and resource type. | | Container Registries | Services used for publishing, maintaining, and securely distributing container images. Supported registries include managed cloud registries (AWS ECR, Azure ACR, Google GAR, and OCI) and third-party integrations (Docker Hub, Docker V2 compliant registries, GitLab, Harbor, JFrog, Sonatype Nexus). | | Container Images | Fundamental, immutable assets that package applications and are uniquely identified by a SHA256 digest. | | Container Instances | Assets dynamically added to the inventory when a drift is detected between a running container and its original image. | | General Devices | Tracks physical and virtual endpoints (such as PCs, laptops, servers, and mobile devices) that are protected by an installed Cortex XDR agent. | | Container Image Repositories | Distinct assets representing the organizational structures within a container registry where images reside to improve management and security isolation. | | Kubernetes Clusters | Provides a comprehensive overview of your Kubernetes (K8s) environment. | | Kubernetes Resources | Individual Kubernetes components tracked in their own dedicated inventory view | | Serverless Functions | Provides comprehensive visibility into the security posture of your serverless functions without the need to install agents | | VM Instances | Tracks traditional, provider-managed virtual machines (like Amazon EC2 instances) | | VM Images | Tracks the machine images associated with your virtualized infrastructure | **Expanded asset information** Clicking on specific compute assets in the inventory table opens a detailed Asset Card with specialized tabs for deep inspection: **CaaS Resources** **CaaS Resources:** Clicking a CaaS asset opens a detailed side card with specialized tabs that vary based on the specific resource type. Common tabs across CaaS assets include an **Overview** of highlights and properties, a **Configurations** tab displaying the asset configuration JSON, and a **Compliance** tab. Depending on the resource type, additional tabs may include: * **Identity:** Provides an aggregated view of the permissions and access graphs associated with the asset * **Code:** Displays the original source definition file retrieved from your cloud environment (such as a Google Cloud Run Job execution template or an Azure Container Group definition) Note that for the actual runtime units spawned from these blueprints, Cortex XDR generates CaaS Container Instance assets only when a runtime drift is detected, limiting creation to a maximum of 50 instances per workload. **Container Images** Container Images are fundamental, immutable assets that package applications and their dependencies for consistent deployment across cloud environments. Each image is uniquely identified by a SHA256 digest, ensuring content verifiability throughout its lifecycle across build, deploy, and run stages. You can assign multiple names and tags to a single container image, allowing you to reference the same image in various contexts and versions within container registries. For more information, see [Container images assets](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/container-image-assets.md). **Container Instances** Drift typically occurs in two scenarios: when an attacker gains access and fetches malicious code not present in the original image, or when a legitimate application dynamically fetches additional software as it loads at runtime. Since legitimate applications can create continuous drift across many instances, the asset inventory limits the amount of data collected by only capturing a sample of these drifted container instances for a given image. This sample provides sufficient evidence to investigate the behavior without creating unnecessary noise in the Asset Inventory. To resolve recurring non-malicious drift, you can either preload the dynamically fetched software into the original image so it can be scanned, or create an issue exception. If an exception is created, the container instances will continue to appear in the asset inventory, but they will no longer generate issues. The asset side card includes: * Detailed asset properties, such as container ID, image, host, cluster, and namespace. * Relationships to the container image, pod, workload, and host machine. * A breakdown of findings and an option to view all associated security issues. * The ability to export the container's image and host data as a Software Bill of Materials (SBOM) in JSON or XML format. * A **Security Drift Detected** highlight and a dedicated **Security Drift** tab, providing visibility into containers that have deviated from their base image. These drifts expose vulnerabilities, misconfigurations, compliance violations, and other security risks introduced at runtime that were not part of the base image. **General Devices** For physical and virtual endpoints, the asset card tracks vital connectivity data including Endpoint Status (Connected, Disconnected, or Lost) and Operational Status (Protected, Partially Protected, or Unprotected). Furthermore, General Devices support Host Insights, which collects extensive business and IT operational data (like installed applications, autoruns, mounted disks, local user groups, and running services) to help analysts quickly identify anomalies on the machine. **Serverless Functions** Cortex XDR provides comprehensive visibility into the security posture of your serverless functions without the need to install agents or disrupt your workloads. The inventory supports AWS Lambda functions, Google Cloud Functions, and Microsoft Azure functions. The system automatically scans these functions during periodic scans or configuration modifications to detect vulnerabilities, malware, and exposed secrets early in the development process. You can proactively detect and address threats across your cloud environment using three categories of serverless function rules: * Attack Path: Identifies combined risks, such as overly permissive roles combined with network exposure, that could be exploited to breach applications * Config: Detects security resource misconfigurations in the function and related pipeline infrastructure * Network Exposure: Detects internet-exposed serverless functions by leveraging monitored network configurations **Kubernetes Clusters** Select any cluster, to view all resources within it and any connected clusters. The Cluster details panel provides a detailed breakdown of assets, and the nodes within each cluster. Choose any of the following tabs for additional information: * Click **Resource Explorer** to view the clusters components and identify any security breaches. Disconnected clusters do not show any data. Ensure all clusters are connected for maximum protection. * Select the **Vulnerabilities** tab to to see a list of all cluster nodes. Click on any cluster to further analyze the vulnerability. You can also find specific container images in the vulnerability list and view the container images, namespaces, and associated K8s deployment. Options include: * **Container Image Vulnerability Findings**: Displays all the vulnerabilities found in the container images running within the cluster. Select any cluster to view vulnerability details such as Max CVSS Severity, Associated K8s Resource Type, etc. * **Kubernetes Nodes Vulnerability Findings**: Provides a detailed view of vulnerabilities effecting the Kubernetes worker and master nodes. Select any node from the table view to see more information, such as Node type, associated Vulnerabilities, and Max CVSS Severity.

Note

The Vulnerabilities tab is only available if the cluster you wish to analyze has a K8s connector.

Select **Kubernetes Connectivity** Management to manage the connector-connectivity of cluster assets, including connector versions, upgrades, statuses, and more. Here, you can check if a cluster is connected, view the status, and see the connector version. You can also update to a new connector version when one is released. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.