> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/compute-assets/vm-images-assets.md).

# VM images assets

Track machine images used by your virtualized infrastructure.

The VM images inventory lists the machine images Cortex discovers in your connected cloud accounts. Use it to see which operating systems and architectures your images use and whether they are public or shared. You can also review their vulnerabilities and compliance results, and see which VM instances were created from each image.

Cortex scans VM images without an agent, so scanning doesn't affect your workloads. To scan an image, Cortex takes a snapshot of the image's disk and scans it in a separate scanning environment. Scans look for software packages, vulnerabilities, malware, secrets, and compliance issues.

Cortex Agentless scanning includes private virtual machine images across the following major cloud platforms:

* **Amazon Web Services (AWS)**: Private Amazon Machine Images (AMIs)
* **Microsoft Azure**: Azure Compute Gallery image versions and managed images
* **Google Cloud Platform (GCP)**: Custom Compute Engine images
* **Oracle Cloud Infrastructure (OCI)**: Custom images
* **Alibaba Cloud**: ECS custom images

After you onboard your cloud account, it is continuously scanned regardless of how many workloads are under that account. Whether you add or remove hosts and containers, agentless scanning keeps your workload’s security issues visible.

**VM images assets inventory**

To access VM images assets, go to **Inventory**, select **All Assets** → **Compute** → **VM Images**.

The VM images assets page includes a dashboard and an inventory table.

**VM images dashboard**

* **Cloud Provider**: Number of VM images on each cloud provider
* **OS Distribution**: Number of VM images for each operating system distribution. For example, Ubuntu, Amazon Linux, or Red Hat Enterprise Linux
* **Architecture:** Number of VM images for each CPU architecture. For example, `x86_64` or `arm64`

**VM images asset table**

The following table describes the default exposed properties of the VM images asset table.

| Column           | Description                                                                               |
| ---------------- | ----------------------------------------------------------------------------------------- |
| Name             | Name of the VM image, as reported by the cloud provider                                   |
| Provider         | Cloud provider that hosts the VM image.                                                   |
| Operating System | Operating system family of the VM image. For example, Linux or Windows                    |
| OS Version       | Release or kernel version of the operating system                                         |
| OS Distribution  | Operating system distribution. For example, Ubuntu, Amazon Linux, or CentOS               |
| Image OS         | Full description of the VM image's operating system                                       |
| Realm            | Cloud account, project, or subscription that owns the VM image                            |
| Region           | Cloud provider region where the VM image is stored. For example, `us-east-1`              |
| Last Observed    | Time Cortex last observed the VM image. The table is sorted by this column, newest first. |
| First Observed   | Time Cortex first discovered the VM image                                                 |
| Architecture     | CPU architecture of the VM image. For example, `x86_64` or `arm64`                        |
| Size             | Size of the VM image                                                                      |
| Created At       | Time the VM image was created in the cloud provider                                       |
| Tags             | Cloud tags or labels on the VM image                                                      |

The following additional properties are available from the column picker:

| Column     | Description                                                                         |
| ---------- | ----------------------------------------------------------------------------------- |
| Scanners   | Cortex scanners that have scanned the VM image. For example: Agentless Disk Scanner |
| Last Scan  | Time of the most recent completed scan of the VM image                              |
| Asset ID   | Unique ID of the VM image in the asset inventory                                    |
| Visibility | Whether the VM image is public or private                                           |
| Is Shared  | Whether the VM image is shared with other accounts                                  |

**VM images asset details**

The VM image asset card provides a unified view of a VM image, consolidating VM details and related configuration issues and vulnerabilities found during VM image scanning.

**Ask the AppSec agentic assistant agent**

From the **VM Images** table, right-click a VM image > **Open in Agentic Assistant** > select **Application Security** from the agents menu, and query VM image specific insights. This action is also available from the VM image side panel.

**Asset card tabs**

* **Overview tab:** Displays a high-level summary of the VM image including OS details, findings, cases, VM scan information, and the relationship graph between the VM instance and the VM image.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If the VM image is not used to create any VM instance, the graph section will show no results. This feature enables you to precisely identify the registry and repository source of any running image, directly linking runtime security findings to their origin. As a result, you can answer audit and security questions, such as determining which registry images are currently deployed in runtime.</p></div>
* **Configurations tab:** Lists all the cloud configuration issues seen during the VM image scanning. The **Asset Configuration JSON** section provides details of the VM image in JSON format.
* **Vulnerabilities tab:** Lists the vulnerability findings during VM image scans as well as the packages with related vulnerabilities found during VM image scans.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/compute-assets/vm-images-assets.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.