Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 12, 2026, 00:00–24:00 UTC · published August 12, 2026 12:28 UTC.

Still waiting on Documentation and Analytics rules. That sync has not landed for this day, so this is a partial picture rather than the whole one.

Last checked about 9 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

Not synced yet — nothing has been recorded for this source on this day.

Not synced yet — nothing has been recorded for this source on this day.

15 packs changed +2488 −132

Six packs get XSIAM 3.19 identity.* modeling rules; MS Graph Security stops mapping every host to the tenant ID

A campaign (CRTX-271523, PRs 1 and 3 of 7) adds a second modeling rule to six packs that mirrors every xdm.*.user.* mapping into xdm.*.identity.*, gated to platform 8.15.0 while the old rule is capped at 8.14.0.
Microsoft Graph Security fixed xdm.source.host.device_id, which was mapped to tenantId and therefore identical on every alert.
Druva gained modeling for Cybersecurity events; PAN-OS added polling to pan-os-platform-get-system-status.
Core removed the SearchIndicatorInEventsAgentix script, superseded by the managed Agentix pack.
SOCRadar and GenericAPICall were Docker image bumps only.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.