> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/investigate-and-remediate-vulnerabilities.md).

# Investigate and remediate vulnerabilities

Learn how to investigate vulnerability issues, findings, and affected assets, then track remediation.

Cortex XDR provides several ways to view and track vulnerability data so you can monitor, investigate, and remediate vulnerabilities in your environment.

## **View all Vulnerabilities**

The **Vulnerabilites** page displays all your vulnerabilities grouped by CVE or other vulnerability ID. This view shows you how prevalent each vulnerability is in your environment. The **Vulnerabilities** page includes key information about each vulnerability, with links to the related lists of instances (also called findings), related issues, and impacted assets.

Go to **Posture Management** → **Vulnerability Management** → **Vulnerabilities**.

## **View vulnerability issues**

The **Vulnerability Issues** page displays all vulnerability issues along with critical vulnerability intelligence and context so you can assign an issue to an owner, investigate, remediate, and track progress. Follow the steps below to view Vulnerability Issues and investigate them further:

1. Go to **Posture Management** → **Vulnerability Management** → **Vulnerability Issues**. Click on an issue in the table to display the issue details panel. You can also optionally generate a .tsv file export of the data if required from the Vulnerability Issues page.
2. The **Overview** tab on the Vulnerability Issues panel captures all the relevant details to further investigate the vulnerability including **Summary**, **Vulnerable Asset and Code Details**, **Security Controls**, and **Remediation Steps**. In addition, you can further isolate the vulnerability by examining the **Exposure Graph**. Use the graph to investigate relationships between K8s Namespaces, Clusters, Workloads, and Container Images.

   ![exposure-graph.png](https://2127116976-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcyIgISZgANJYkmLlnwdK%2Fuploads%2Fgit-blob-29f578860eea1a4f311c7ff4a1f285e2373a4f5f%2F3dfb2f9082e2a037fd5c66555c1a82d235f34de67bcda0b1ddfb9515d420fdf7.png?alt=media)
3. Review the Exposure Graph to understand where the vulnerability originates and how it impacts Findings and Assets. Select **More Info** to view granular details about each of the impacted assets.
4. You can also select **View Details** from the Details view to be directed to the Finding or Asset in question.

## **View All Vulnerability Findings**

A vulnerability finding is a specific instance of a vulnerability that was discovered in your environment. The **All Vulnerability Findings** page lists every instance of every vulnerability that was discovered in your environment.

Go to **Posture Management** → **Vulnerability Management** → **Vulnerability Issues** and click the **All Vulnerability Findings** button.

## **View vulnerable assets**

The **Vulnerable Assets** page displays all assets with a vulnerability finding. This view enables you to prioritize vulnerabilities by asset and asset type and focus on assets most critical to fix. The **Vulnerable Assets** list provides links to the findings and issues for each asset. Click on an asset in the table to see the asset details.

Go to **Posture Management** → **Vulnerability Management** → **Vulnerable Assets**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/investigate-and-remediate-vulnerabilities.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.