Platform Changes

A mix of real integration work landed alongside a large [AUD Isolation] PaloAltoNetworks_IoT bookkeeping commit that re-added ~82,000 files across virtually every pack in the catalog — that commit is a repository snapshot from an internal isolation/build process, not a day of content change, and is excluded from the detail below.

• ThreatMon shipped a new ThreatMon Threat Feed pack, and the base ThreatMon integration gained threatmon_list_cves and threatmon_list_subscribed_cves commands.
• Sysdig cut a breaking v2.0.0: the incoming mapper was rewritten for the real Secure V2 webhook payload (the old mapper targeted fields that didn’t exist), 34 new incident fields were added, and execute-response-action now supports all 24 response action types with per-action validation. Agent ID/Customer ID are no longer supplied by the webhook and must be resolved via a new sysdig-agent-info-get command.
• GravityZone’s gz-endpoint-list command gained recursive listing across managed companies plus new filters and output fields.
• Anthropic Claude integration added claude-chat-file-delete and claude-project-document-delete commands.
• Doppel fixed duplicate incident creation in fetch-incidents (now paginated and de-duplicated by alert ID) and switched to the API’s max page size.
• Cybersixgill Actionable Alerts moved case-details/alert-info URL construction into integration code and appended the organization ID as a query parameter.
• Microsoft Entra ID parsing rule added a time field fallback for events missing TimeGenerated.
• Base pack bumped Docker images for GetMLModelEvaluation, DBotPredictPhishingWords, and GetIndicatorsByQuery.