> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Understand assets

> Trace a dependency from a scanned repository to its manifest, package usage, and affected repositories.

Cysmiq connects VCS structure and scan results into an asset graph. Repositories contain manifests, manifests declare packages and versions, and applications group related repositories for product-level reporting.

Use this workflow to answer a common dependency question: **Which repositories use this package?**

## Prerequisites

* A workspace with at least one repository that has completed dependency scanning
* Permission to view repositories, manifests, and packages

## Steps

<Steps>
  <Step title="Start with a repository">
    Open **Repositories** under **Assets** and find the codebase you want to investigate. The list connects each repository to its VCS organization, scan state, vulnerability counts, and latest scan.

    <Frame caption="The storefront repository in the asset inventory.">
      <img src="https://mintcdn.com/cysmiq/jILg5Q1KdyGSo81w/images/guides/understand-assets/understand-assets-01-repository.webp?fit=max&auto=format&n=jILg5Q1KdyGSo81w&q=85&s=1270d0df59fbc76b09e0d50751e073da" alt="Repositories page filtered to the Northstar Retail storefront repository." width="2880" height="2160" data-path="images/guides/understand-assets/understand-assets-01-repository.webp" />
    </Frame>

    Open the repository when you need its overview, refs, recent scans, vulnerabilities, settings, or repository-level SBOM export.
  </Step>

  <Step title="Find its manifest">
    Open **Manifests** and select the dependency file discovered for the repository. A manifest records the source file, package manager, repository, ref, and the direct and transitive dependencies Cysmiq found.

    <Frame caption="The storefront requirements file and its direct Flask dependency.">
      <img src="https://mintcdn.com/cysmiq/jILg5Q1KdyGSo81w/images/guides/understand-assets/understand-assets-02-manifest.webp?fit=max&auto=format&n=jILg5Q1KdyGSo81w&q=85&s=5084709cddc950a6ac9ead5f34d4807d" alt="Manifest detail page for requirements.txt showing Flask as a direct dependency of the storefront repository." width="2880" height="2160" data-path="images/guides/understand-assets/understand-assets-02-manifest.webp" />
    </Frame>

    Use **Production** for the normal runtime dependency view. Select **All** when you also need development or other non-production dependency groups. The manifest summary also provides a manifest-level **Download SBOM** action.
  </Step>

  <Step title="Open the package">
    Select a package in **Direct Dependencies**, **Transitive Dependencies**, or the **Dependency Tree**. The package view combines the versions Cysmiq observed with license, usage, repository, and vulnerability information.

    <Frame caption="The Flask package with its observed version and usage counts.">
      <img src="https://mintcdn.com/cysmiq/jILg5Q1KdyGSo81w/images/guides/understand-assets/understand-assets-03-package.webp?fit=max&auto=format&n=jILg5Q1KdyGSo81w&q=85&s=f11948b6b3433e25d552869ae0ea5148" alt="Flask package detail page showing its observed version, direct usage, manifest count, and repository count." width="2880" height="2160" data-path="images/guides/understand-assets/understand-assets-03-package.webp" />
    </Frame>
  </Step>

  <Step title="Trace where the package is used">
    Use the linked counts on the package or package-version row:

    * **Direct Usage** opens manifests that declare the package directly.
    * **Transitive Usage** opens manifests where another dependency introduced it.
    * **Total Manifests** opens every manifest that references the package.
    * **Repositories** opens the repositories whose manifests contain the package.
    * **Vulnerabilities** opens active dependency findings linked to the package or version.

    The destination list keeps the package or version filter applied. Review every returned repository before coordinating an upgrade or policy decision.
  </Step>

  <Step title="Continue from the asset relationship">
    Open a returned repository to review its scans and findings, or use the appropriate SBOM export for the scope you need:

    * Repository export for one codebase
    * Manifest export for one dependency file
    * Application export for a product or service composed of several repositories

    See [Manage applications](/guides/manage-applications) when you need to create or change those product-level groups.
  </Step>
</Steps>

## Related documentation

* [Asset types and relationships](/concepts/assets)
* [Repositories](/assets/repositories)
* [Manifests](/assets/manifests)
* [Packages](/assets/packages)
* [Organizations](/assets/organizations)
* [SBOMs](/concepts/sboms)