Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering July 27, 2026, 00:00–24:00 UTC · published July 27, 2026 12:36 UTC.

Still waiting on Documentation and Analytics rules. That sync has not landed for this day, so this is a partial picture rather than the whole one.

Last checked about 21 hours ago. Summaries are written by claude-code/claude-sonnet-5; the changes themselves are recorded automatically.

Documentation

Not synced yet — nothing has been recorded for this source on this day.

Not synced yet — nothing has been recorded for this source on this day.

2 packs changed +14109 −7

New Vega integration pack added; FortiGate modeling rule crash fixed

A quiet day: one new pack and one bug fix.

Vega is a new integration pack that ingests alerts and incidents from the Vega platform, with dedicated incident/alert fields for detections, MITRE ATT&CK mapping, verdicts, and an external-IP enrichment playbook.
FortiGate’s modeling rule crashed when saddr held an address-object name with an embedded IP (e.g. Ransom_140.88.40.4) instead of a bare IP, raising “is not a valid IP address” in incidr(). The rule now extracts the embedded IP before evaluating it.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.