Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering July 28, 2026, 00:00–24:00 UTC · published July 28, 2026 19:53 UTC.

Still waiting on Documentation and Analytics rules. That sync has not landed for this day, so this is a partial picture rather than the whole one.

Last checked about 20 hours ago. Summaries are written by claude-code/claude-sonnet-5; the changes themselves are recorded automatically.

Documentation

Not synced yet — nothing has been recorded for this source on this day.

Analytics rules

Not synced yet — nothing has been recorded for this source on this day.

Content packs

25 packs changed +656 −90

PAN-OS polling timeouts made configurable; ServiceNow gains note-formatted attachments

  • PAN-OS made the polling timeout/interval configurable on its content-, antivirus-, WildFire-, and GlobalProtect-update download/install commands, replacing a hardcoded 300s timeout / 10s interval with defaults of 3600s / 30s.
  • ServiceNow v2 added a Mark attachment as note parameter and an Interpret comments in a specific format parameter (Source, Text, or HTML), plus a Docker image bump.
  • Microsoft Graph Files (Standard Connector) was un-deprecated (the deprecated: true flag was removed from the integration YAML).
  • A routine auto-generated Docker image update PR bumped images across 22 unrelated packs (AccentureCTI_Feed, MISP, GitHub, Zabbix, and others) — bookkeeping, not functional change.
  • Core picked up a release-notes/metadata-only bump (3.5.75 → 3.5.76) from an automated RN sync.
  • AccentureCTI_Feed
  • AnomaliThreatStreamFeed
  • Anomali_ThreatStream
  • ArcherRSA
  • CommunityCommonDashboards
  • CommunityCommonScripts
  • and 19 more

See what changed →

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.