Platform Changes
Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.
Covering July 30, 2026, 00:00–24:00 UTC · published July 30, 2026 16:31 UTC.
Still waiting on Documentation and Analytics rules. That sync has not landed for this day, so this is a partial picture rather than the whole one.
Last checked about 19 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.
Documentation
Not synced yet — nothing has been recorded for this source on this day.
Analytics rules
Not synced yet — nothing has been recorded for this source on this day.
Content packs
10 packs changed +6780 −1776New Binalyze AIR Extended forensics pack; Reco 1.8.0 migrates to the External API
- Binalyze AIR Extended is a new community-supported pack: 28
binalyze-air-*commands covering forensic acquisition, triage rules, cases, tasks, repositories and endpoint isolation. - Reco 1.8.0 migrated alert, identity, app, file and label commands to the Reco External API and added 14 new list commands taking SCIM v2 filter expressions.
- Reco’s Risk level fetch parameter changed meaning: it now fetches the given severity and above rather than an exact match, so existing instances will ingest more alerts.
- Slack v3 fixed SlackBlockBuilder and SlackAsk failing inside a Cortex Platform Case War Room, where investigation IDs take the form
INCIDENT-<n>. - HPE Aruba Central added an authentication-method choice, and Feedly, Flashpoint, ThreatQ and ReadQRCode took targeted fixes.
- BinalyzeAIRExtended
- CloudSecurityPostureManagement
- CommonScripts
- CortexResponseAndRemediation
- FeedFeedly
- Flashpoint
- and 4 more
BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.