Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 19, 2026, 00:00–24:00 UTC · published August 20, 2026 03:47 UTC.

Last checked about 4 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

15 pages changed +318 −129

IoT Security collector deprecated for a new Device Security one; authentication mapping rewritten

  • The IoT Security data collector is marked deprecated and a new Device Security collector replaces it, keeping both existing datasets.
  • Authentication mapping was rewritten around a 15-field mandatory set, and xdm.auth.service gained a third value, Universal.
  • Allow and block lists now accept script and Java file types on Windows, Mac and Linux.
  • Quarantine gained per-OS folder paths, a 180-day retention and a configurable pending-action expiry.
  • The rest is restructuring — the architecture, XTI and role-scoping pages were reorganized without changing what they say; the XSIAM book is now 2,283 pages.
  • README
  • Navigation manifest (xsiam)
  • Deploy the Terraform authentication template in OCI
  • IoT Security
  • Ingest alerts and assets from Device Security
  • Ingest alerts and assets from IoT Security (Deprecated)
  • and 9 more

See what changed →

Analytics rules

0 rules changed +0 −0

Synced, and nothing changed upstream.

Content packs

36 packs changed +8562 −460

Six identity.* modeling-rule PRs land in one day; Orca's event collector fixes pagination

  • The identity.* modeling-rule series lands in bulk: PRs 1, 2, 4, 5, 6 and 7 of 7 all merge on the same day (#45448, #45565, #45438, #45436, #45437, #45462).
  • Yesterday’s revert is undone — GuardiCore (+962), Silverfort (+177), CommvaultBackupSolutions (+121) and CitrixADC (+117) regain almost exactly the lines PR 2’s revert removed.
  • 36 packs move and 19 of them are addition-only against a single deleted line; Azure (+1,383) and Orca (+1,160/-242) are the largest.
  • Two collection fixes land: XDR Collector RFC-3164 syslog now ingests into linux_linux_raw (#45574), and Arista Switch parsing accepts millisecond timestamps (#45571).
  • AMP
  • AWS
  • AristaSwitch
  • Armis
  • Azure
  • BarracudaEmailProtection
  • and 30 more

See what changed →

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.