Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 11, 2026, 00:00–24:00 UTC · published August 11, 2026 20:28 UTC.

Last checked about 10 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

314 pages changed +354 −437

Marketplace links restored on 296 data-source pages; Cloud Application Security rewritten with licensing

296 XSIAM data-source connector pages turned a plain-text Marketplace mention into a working link — the bulk of the day, and the only change on those pages.
Cortex Cloud Application Security was rewritten around three use cases and now states which base licence each one needs.
Nine Cortex XDR agent pages replaced their markdown tables with raw HTML, and several console names picked up bold.
Outbound links in the agent guide moved from docs-cortex.paloaltonetworks.com to app.gitbook.com spaces.
Nothing was added, deleted or renamed: all 316 files were modifications.

0 rules changed +0 −0

Synced, and nothing changed upstream.

24 packs changed +3400 −249

Horizon3.ai NodeZero pack added; Akamai WAF SIEM splits incident and event fetch limits

NodeZero 1.0.0 is a new partner pack from Horizon3.ai that fetches high and critical weaknesses from autonomous pentest operations as incidents.
Akamai WAF SIEM 1.3.0 is a flagged breaking change: the Fetch limit parameter was renamed and split into separate incident and event limits, and Akamai Page size was removed.
Amazon Web Services 2.6.0 added aws-s3-bucket-objects-list-v2, built on the ListObjectsV2 API.
Two small fixes: PAN-OS job polling stopping early, and a stray space in a GCP context output.
An automated Docker bump touched 18 packs.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.