Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 13, 2026, 00:00–24:00 UTC · published August 13, 2026 15:17 UTC.

Still waiting on Documentation and Analytics rules. That sync has not landed for this day, so this is a partial picture rather than the whole one.

Last checked about 8 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

Not synced yet — nothing has been recorded for this source on this day.

Analytics rules

Not synced yet — nothing has been recorded for this source on this day.

Content packs

4 packs changed +254 −48

Azure Key Vault serves credentials on demand; Entra ID IPv6 caller IPs reach the Authentication story

  • A quiet day: four commits across four packs, 22 files, no new or withdrawn packs.
  • Azure Key Vault gained a Credentials Fetch Mode parameter whose on-demand mode keeps secret values out of the Cortex credentials store.
  • Microsoft Entra ID rewrote its caller-IP extraction so IPv6 addresses populate in the Authentication story, and added xdm.source.ipv4/ipv6.
  • GreyNoise added Trust Level 3 handling and stopped querying the installed-pack API for its own version; Picus Security NG moved one command to the v2 endpoint.
  • AzureKeyVault
  • GreyNoise
  • MicrosoftEntraID
  • PicusNGAutomation

See what changed →

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.