> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/application-asset-queries/application-asset-examples.md).

# Application Asset Query Examples

Learn how to build and analyze Application Asset queries.

## Query Example #1

Find all code repositories that have a `CODEOWNER` file but the repository’s branch protection rule is not using it. Utilizing the `CODEOWNER` file in branch protection rules can improve security and code quality since any pull request that modifies code owned by a code owner must be approved by that code owner before the pull request can be merged into the protected branch.

1. Select **Application Asset** from **Find**.
2. In **Type** select **VCS repository**, which represents a repository.
3. In **WHERE**, select **Has Code Owner** > **is** > **true**.
4. Select a branch protection rule attribute: **Add** > **That Contains VCSBranchProtectionRule**.

   The **VCSBranchProtectionRule** is displayed in the **\[THAT CONTAINS]** field.
5. Select a rule. In **WHERE**: **Add** > **Is Code Owner Reviews Required** > **is** > **false**.
6. Select the branch: **Add** > **That Protects VCSBranchPattern** > **Name** > **is** > **main**.
7. Select **Search**.

   The query results are displayed.

   <figure><img src="/files/T53GStPnAzyYWexISP3K" alt="investigate eg4.1"><figcaption></figcaption></figure>

## Query Example #2

Find all VCS deploy keys that have **write** permissions.

To minimize the risk of a stolen deploy key being used by an attacker, it is recommended to reduce the level of permissions of all deploy keys to **read-only** when write permissions are not necessary for the pipeline to function properly.

<figure><img src="/files/JSemPyb0ltyl9Q1fNq7y" alt="investigate eg2.1"><figcaption></figcaption></figure>

## Query Example #3

Find all private code repositories that can be forked.

An attacker could use a fork to create a pull request that triggers a pipeline, which could then be used to deploy malicious code to your production environment. If you do not need to allow forks, it is best to disable fork permission for each repository, preferably at the organization level.

<figure><img src="/files/KePeJxM6eVaBqlr6qkkv" alt="investigate eg5.1"><figcaption></figcaption></figure>

## Query Example #4

Find all code repositories that import packages infected with the **CVE-2017-20165** vulnerability through package files.

1. Select **Investigate** on the Prisma Cloud console.
2. Select **Application Asset** from the **Select a Query Type** field.
3. Under **Type**, select **VCSRepository**, which represents a repository.
4. Add clauses:
   1. Click **+ Add** > **That Contains PackageFile**.
   2. Click **+ Add** > **That Depends On Package**.
   3. Click **+ Add** > **That Has Vulnerability**
   4. Click **+ Add** > **id** > **is** > **CVE-2017-20165**.

      <figure><img src="/files/ZiMxWIqLEmDQQmLRxpxr" alt="sbom dep graph query1.1"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/application-asset-queries/application-asset-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.