> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/c2c-tracing-vulnerabilities/investigate-vulnerabilities-tracing.md).

# Use Vulnerabilities Tracing on Investigate

You can benefit from the C2C vulnerability tracing automatically since everytime you select a runtime workload where tracing is available, the Investigate graph will automatically identify the root cause of a vulnerability and it’s content.

Use [Prisma Cloud Copilot](/content-collections/prisma-cloud-copilot/prisma-cloud-copilot-benefits.md) to easily find, understand, and manage vulnerabilities in your cloud environment.

<figure><img src="/files/1lGV2WEVfHzQIE7xDuIg" alt="c2c tracing 4"><figcaption></figcaption></figure>

The assets can be in one of the following three available states:

* **Not Available—** Cannot trace from Runtime to Deploy.
* **Partial—** Tracing is possible from Runtime to the Registry Image.
* **Complete—** Tracing is possible from Runtime back to the Code Repository.

To search for a vulnerability, select an asset and click **View C2C Tracing**.

<figure><img src="/files/ALuVm9RBouYN4zkH3hVN" alt="c2c tracing 1"><figcaption></figcaption></figure>

## Remediate a Vulnerability

You can take action to remediate a vulnerability by selecting **Submit Pull Request** or **Create Ticket** available in the CVE sidecar or directly from the vulnerability graph.

When you want to select **Submit Pull Request** (PR), one of the following three outcomes are possible:

* **C2C PR—** Creates a PR for the specific vulnerable packages used to create the selected deployed container image. Once you select the workload in the CBDR graph, the preview card opens and if C2C tracing is possible for the vulnerability under analysis, only then the **Submit Pull Request** option is available.
* **Global PR—** Creates a PR for all vulnerable packages across all repositories. Open the CVE sidecar and click on **Submit Pull Request** to create a PR for all vulnerable packages.
* **Package PR—** Creates a PR for a specific package. Open the CVE sidecar, navigate to the impacted Assets tab, expand the Packages tab, and select the specific package for which you want to create a PR.

## Limitations

* Currently, only manual tracing is supported.
* Tracing vulnerabilities from base images is not supported.
* Exporting C2C results into a CSV export file and JIRA ticket is not supported.
* Tracing vulnerabilities for Virtual Machines and Serverless Functions is not supported.

## Troubleshooting

* If the C2C tracing is not working, it may be due to an issue of tracing the correct pipelines and repositories. Check if the ID of the image in production is the same as in additional scan stages.

  <figure><img src="/files/Lj6p5mT7GJBAOlLPy7Dy" alt="c2c ts 1"><figcaption></figcaption></figure>

  <figure><img src="/files/BXI2XGZ34iOPpGItsuan" alt="c2c ts 2"><figcaption></figcaption></figure>
* Depending on the pipeline build, the ID output needs to be adjusted to fit the CAS regex. Here’s an example of a step that echoes the image digest in a step adjusted to CAS:

  <figure><img src="/files/36YxFwguqkFRIgIP1i4y" alt="c2c tracing 2"><figcaption></figcaption></figure>
* The example above is for GitHub actions. Additionally, IDs that generate the same tags could generate issues with multiple following runs.

  <figure><img src="/files/VQzx4NaDzuNh2IN44JK5" alt="c2c tracing 3"><figcaption></figcaption></figure>
* In this case the tag is actually the pipeline run ID, which guarantees that each run will have it’s specific tag.

## Verify Image Digest in Pipeline Logs

To check the pipeline logs:

1. Click on latest action and expand the **Output image digest** step.

   <figure><img src="/files/sOM3yVQBGXIpXRKabzIV" alt="verify image 1"><figcaption></figcaption></figure>
2. Go to your repository home page and click **Packages**.

   <figure><img src="/files/6iao0bleFiXxe2mOFojj" alt="verify image 2"><figcaption></figcaption></figure>
3. Expand the latest version to verify the digest from the previous step.

   <figure><img src="/files/GVyjxFlcsH2jV3Mf24KO" alt="verify image 3"><figcaption></figcaption></figure>
4. Connect to your Prisma Cloud tenant and search for Code to Cloud from **Runtime Security > Monitor > Vulnerabilities > Images > Deployed**, click on the image that was deployed on your Kubernetes cluster and verify the hash from previous step.

   <figure><img src="/files/nglFuHjua4IJhrTD3YOU" alt="verify image 4"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/c2c-tracing-vulnerabilities/investigate-vulnerabilities-tracing.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.