> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/c2c-tracing-vulnerabilities.md).

# Code to Cloud Tracing for Vulnerabilities

The unified **Vulnerability Explorer** can identify a vulnerability in container images deployed in runtime and trace it back to it’s source in code repositories.

## Overview

Traditional vulnerability scanners provide a list of vulnerabilities and the underlying binaries introducing them, after which you need to find out how to properly update the vulnerable packages and to which version. Prisma Cloud goes beyond what traditional scanners can do by allowing you to find exactly how a vulnerability was introduced into your container images.

The Code to Cloud (C2C) tracing engine relies on the unique set of data available to Prisma Cloud in order to identify all the vulnerabilities found on a runtime container image, match which registry image was used in the deployment, discover what pipeline was used to build it and from there, identify which Dockerfile contains the instructions to build the image, and the Package Manager file and packages pulled into it and it’s Base Image.

Finally, Prisma Cloud scans all the source components to find which ones have the same vulnerability found in runtime and builds the trace.

## How C2C Tracing Works

* For a given deployed container, Prisma Cloud determines the corresponding Image Registry from which the image is deployed.
* From the image in the Image Registry, Prisma Cloud finds the CI/CD pipeline and CI jobs that have built the image and the code repository that triggered the CI/CD pipeline.
* Prisma Cloud further determines the corresponding Dockerfile or Package Manager (if applicable) and it’s associated packages, which are vulnerable to the CVE under analysis.
* If the base image is found to be vulnerable to the CVE under analysis, Prisma Cloud presents it in the graph.

## Prerequisites

Make sure that you fulfill the following prerequisites:

* Repositories are [onboarded](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/code-repositories) on to Prisma Cloud (only organizations are supported).
* CI/CD systems are [onboarded](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-systems/ci-cd-systems) on to Prisma Cloud.
  * Ingested pipelines are being used to build the container images used in the production environments.
* Registry images are [scanned](https://docs.prismacloud.io/en/compute-edition/32/admin-guide/vulnerability-management/registry-scanning/registry-scanning) for vulnerabilities.
* Runtime workloads are scanned for vulnerabilities using [agentless](https://docs.prismacloud.io/en/compute-edition/32/admin-guide/agentless-scanning/agentless-scanning#agentless-scanning) or [agent-based](https://docs.prismacloud.io/en/compute-edition/32/admin-guide/install/deploy-defender/deploy-defender) scanning.
* Vulnerability policies are [configured](https://docs.prismacloud.io/en/enterprise-edition/content-collections/runtime-security/vulnerability-management/vulnerability-management-policies).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/c2c-tracing-vulnerabilities.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.