Investigate VCS organization assets - Administrator Guide - Cortex XSIAM - Cortex Cloud Posture Management - Cortex CLOUD - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product
Cortex XSIAM
Creation date
2025-07-15
Last date published
2026-06-04
Category
Administrator Guide

The VCS organization inventory provides multiple ways to investigate an asset, from quick agentic queries in the main table to deep-dive investigations in the side panel.

Select a VCS organization row in the table to open its side panel. This provides a consolidated workspace for investigating organization-level security posture and remediating associated security issues without navigating away from the asset inventory.

Ask the AppSec agentic assistant

From the VCS Organizations table, click the Agentic Assistant icon and select Application Security from the agents menu to query organization-specific insights.

Additionally, you can click Ask AI in the side panel to access the Agentic agent.

Explore the VCS organization context

Navigate through the following tabs in the side panel to review the organization context and security posture. This helps prioritize remediation efforts based on the aggregated risk profile, repository count, and business criticality:

  • Overview tab: Displays the severity breakdown of security issues associated with the VCS organization, aggregated from all child repositories and CI/CD instances. It includes the following highlights:

    • Repository Count: The total number of repositories within the organization, providing scale context for the governance boundary

    • Coverage Percentage: The ratio of scanned repositories to total repositories, indicating how much of the organization is under active security monitoring

    • Internet Exposed: Whether the organization contains repositories that ultimately power publicly reachable cloud endpoints, flagging organizations that should be prioritized for security review

  • Identity tab: Provides a view of users within the VCS Organization, outlining their access levels and the repositories they are collaborators on, along with the timestamp of the latest commit for each repository

Investigate and remediate issues

You can investigate specific security findings directly from the asset side panel. From the Configurations tab, select specific configuration issues or cases associated with the VCS organization.

Selecting an issue opens a dedicated issue side card directly over the inventory view. The issue side card displays detailed information including the severity level and remediation guidance, enabling you to review and apply remediation guidance without losing your place in the asset inventory.

You can also access the full Issues page (Application SecurityIssues) with filters pre-applied for the VCS organization. The full Issues page provides additional capabilities not available in the side panel.

Execute asset actions

After reviewing the organization's health, you can perform the following operations from the Actions menu in the side panel:

  • Open in Provider: Click Open in Provider to navigate directly to the VCS platform console (for example, the GitHub organization page or the GitLab group page) at the organization URL

  • View asset data: Click View asset data to view raw VCS organization asset data in JSON (default) or tree view formats to assist with custom integrations, XQL queries, or API operations