Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 16, 2026, 00:00–24:00 UTC · published August 16, 2026 16:11 UTC.

Still waiting on Documentation and Analytics rules. That sync has not landed for this day, so this is a partial picture rather than the whole one.

Last checked about 6 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

Not synced yet — nothing has been recorded for this source on this day.

Not synced yet — nothing has been recorded for this source on this day.

32 packs changed +34685 −1574

Cyberhaven DLP pack lands at 1.0.0; Elasticsearch v2 gains two-way case and alert mirroring

19 commits, 225 files net across 26 packs — one new partner pack, Cyberhaven 1.0.0, for DLP incident fetch and data-lineage investigation.
Elasticsearch v2 1.6.0 turns into a mirroring integration: two new incident types, four mappers, eight incident fields and the three *-remote-* commands.
Ten packs each gained a second modeling rule mapping xdm.*.identity.* alongside xdm.*.user.*, with the existing rule capped at toversion: 8.14.0.
Microsoft Graph Security 2.6.0 now fetches incidents as well as alerts; Okta Event Collector 3.4.0 retries HTTP 429s.
Two rounds of Docker base-image bumps (XSUP-74966, XSUP-71787) landed and were reverted the same day — no net change to HealthCheck, GitHub, Defender for Endpoint or ZipFile.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.