Defining ownership

Ownership is a core use case of Cortex, as many organizations seek to establish accurate ownership of services, data, and other entities. Accurate ownership is foundational for accountability, incident response, security reviews, compliance, and developer productivity. Without clear ownership, critical issues can go unresolved and services can fall through the cracks.

Ownership can be defined by accepting Cortex's automated recommendations for ownership, pulled in from third-party integrations, or defined manually in the Cortex UI. Ownership can also be inherited from an entity's fallback or append configuration.

Ownership drives which users will receive notifications from Cortex, including alerts for on-call changes, when verification is needed on an assigned entity, when an entity is re-evaluated and its Scorecard changes, and more.

Where to view entity owners

When viewing an entity, the owners appear in the metadata bar on the right side of the page:

Click into the team name to view the team's entity page, including a list of members and a list of entities owned by that team.

You can create or import the teams and users who will be defined as owners for your entities.

Define owners for entities

Types of owners

You can define owners based on:

• A team: The user is a member of a team that is listed as the owner of an entity.

  • We recommend setting up teams as owners. If you link a group in your YAML file from a different platform (such as Okta), the members of the team will be automatically updated in Cortex if anyone leaves your organization and is removed from your integrated identity provider.

• A user email address: The user is listed as the owner of an entity.

• Fallback or append settings configured in an entity's hierarchy.

Methods for defining ownership

Owners can be defined:

• By accepting Cortex's automated recommendations for owners, based on repository activity

• By pulling information from third-party integrations in the entity descriptor YAML

  • Ownership can also be inherited via fallback or append configuration.

• Directly in the Cortex UI

• Automatically if Cortex detects that an entity is owned by a team that does not yet exist in Cortex

  • If an entity's YAML references a team, but that team doesn't have a corresponding entry within Cortex, Cortex will automatically create a team. The team will include a label that says Automatically created by Cortex.

x-cortex-owners:
  # Groups can be pulled from various integrations
  - type: group
    name: my-team
    provider: CORTEX
    description: This is a description for this owner # optional
  - type: email
    email: [email protected]
    description: This is a description for this owner # optional

Ownership inheritance

Instead of defining ownership individually for every entity in your catalog, you can define ownership at the parent entity level and have that pass down to all of the entity's children. You can configure this in the Cortex UI while creating a domain entity and adding owners to it, or while creating an entity relationship.

inheritance can also be defined in the entity descriptor under the x-cortex-owners block, as shown in the example below:

openapi: 3.0.1
info:
  title: Payments
  description: This is my cool domain.
  x-cortex-tag: payments-domain
  x-cortex-type: domain
  x-cortex-owners:
      - type: GROUP
        name: cortexapps/engineering
        provider: GITHUB
        inheritance: APPEND

The inheritance type for each owner can be one of APPEND, FALLBACK, or NONE. If not set, inheritance is defaulted to NONE.

• APPEND: This owner is appended to the list of owners for all child entities.

• FALLBACK: In the case where a child has no valid owners, including fallbacks, this fallback will be assigned as the owner. Note that this only applies to a child entity down the hierarchy; it is not the fallback for the parent domain itself.

• NONE: This owner owns the domain, but not necessarily any of its children (no inheritance).

Automatic discovery for AWS

Cortex can automatically discover ownership for your AWS resources using their owner tag. To enable this, make sure that your AWS resources have an owner tag matching the x-cortex-tag of the corresponding Cortex team and enable the Sync ownership from AWS toggle in Settings > AWS.

You can pull in all resources from AWS, and Cortex syncs those owners automatically based on their tags in AWS, allowing you to easily keep the resource owners up to date.

Viewing entity ownership

View your owned entities

To see a list of entities you own directly, navigate to Catalogs > All entities then click the Mine tab:

Child team visibility

To see a list of entities you own directly and entities that are owned by your team's child teams:

1. Navigate to Catalogs > All entities.

   1. The list defaults to displaying the "Mine" tab, showing only the entities you own.

2. At the top of the list, click Display.

3. Enable the toggle next to Include child teams.

   
4. Click Done.

View a team's owned entities

You can filter the entity list by owner:

1. Under Catalogs > All entities, click the All tab.

2. In the upper right corner, click Filter.

3. In the left side of the filter modal, click Teams. Select teams from the dropdown, then click Apply at the bottom.

View entities owned by all teams within a hierachy

Teams can exist within hierarchies. You can view a list of all entities that are owned by the parent team and all children teams in the hierarchy:

1. Navigate to the parent team's page in Cortex.

2. Click the Entities tab.

3. Click Display, then enable the toggle next to Inherited Children.

   
4. Click Done.

The list will now display all entities owned by the parent and its children teams. Note that this setting does not persist when you navigate away from the page.

Read more about hierarchies in Setting up a team hierachy.

Ownership settings in Cortex

Under Settings > Entities, there are several settings relating to teams. Read more about these in the Teams documentation.