Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering July 29, 2026, 00:00–24:00 UTC · published July 29, 2026 20:03 UTC.

Still waiting on Documentation and Analytics rules. That sync has not landed for this day, so this is a partial picture rather than the whole one.

Last checked about 19 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

Not synced yet — nothing has been recorded for this source on this day.

Not synced yet — nothing has been recorded for this source on this day.

13 packs changed +2383 −93

CrowdStrike Falcon event fetching restricted to XSIAM tenants; F5 BIG-IP iRule HTTP logs supported

CrowdStrike Falcon fixed ingestion latency when fetching events, and limited event fetching to Cortex Platform tenants with the XSIAM module — it is no longer available on EDR, Cloud, or Cloud Runtime Security tenants.
F5 BIG-IP LTM added parsing and modeling support for iRule HTTP access logs (ir-log_http), a new log source with client- and server-side connection details.
AWS gained three Network Firewall subnet commands: associate, disassociate, and subnet-change-protection update.
A FormatURL bug that mangled percent-encoded spaces — corrupting indicator extraction — was fixed in both the script and the shared API module.
The rest of the day is fixes: Elasticsearch fetch parsing, Netcraft lookback, PAN-OS job polling, and similar-incident hyperlinks on XSOAR 8.x.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.