> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/visibility/sbom/package-dependency-graph.md).
# Package Dependency Graph
Prisma Cloud’s **Investigate** feature offers a Package Dependency graph. This graphical representation of your [SBOM](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/visibility/sbom/sbom.md) allows you to explore package dependencies in your code repositories through the [Simple Mode Query](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/search-and-investigate/application-asset-queries/application-asset-queries.md) builder. You can investigate both transitive and intransitive packages, including their licenses and vulnerabilities.
**Requirement**: To use the graph, you must first enable the CAS SCA module. For more information on SCA licenses, refer to [Prisma Cloud License Types](/content-collections/administration/prisma-cloud-licenses.md).
## Query Example
Find all code repositories that import packages infected with the **CVE-2017-20165** vulnerability through package files.
1. Select **Investigate** on the Prisma Cloud console.
2. Select **Application Asset** from the **Select a Query Type** field.
3. Under **Type**, select **VCSRepository**, which represents a repository.
4. Add clauses:
1. Click **+ Add** > **That Contains PackageFile**.
2. Click **+ Add** > **That Depends On Package**.
3. Click **+ Add** > **That Has Vulnerability**.
4. Click **+ Add** > **id** > **is** > **CVE-2017-20165**.
The query results are displayed as a graphical representation.
## Legend
* Numbers next to the VCS Repository node: represent the grouping and amount or repositories containing the package file
* Numbers next to the PackageFile node: represent the grouping and amount of package files depending on the package
* Numbers next to the Package node: represent the grouping and amount of packages including the CVE vulnerability
* The edges describe the relationships between the nodes
* Clicking on a number expands the node, allowing you to drill-down for additional details by clicking on each child entity
* Clicking on a vulnerability displays its details, such as severity, CVSS score, impacted stages and more
A link icon on an edge denotes indirect dependencies. Click on the icon to view details of the indirect dependency between a package file and its package.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/visibility/sbom/package-dependency-graph.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.