Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 20, 2026, 00:00–24:00 UTC · published August 21, 2026 03:54 UTC.

Last checked about 3 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

232 pages changed +1551 −588

233 Cortex XSIAM pages restyled for search; SaaS section renamed; 18 compliance standards added

Every changed file is in the Cortex XSIAM book: 192 modified and 41 renamed, with no page added or deleted.
Mostly an authoring pass — 97 pages changed only by gaining a description: frontmatter line, and 12 page titles were rewritten into keyword-rich forms.
The SaaS Security onboarding section moved from onboard-a-supported-saas-application to connect-a-saas-application, taking 40 application pages with it.
The one substantive change is the compliance standards catalog, which gained 18 standards including CIS benchmarks for Ubuntu 24.04 LTS, Debian 13 and AWS Foundations v7.0.0.
Egress, inbound and engine IP tables, supported regions, retention periods and licence tiers were all re-headed, but no value in them changed.

0 rules changed +0 −0

Synced, and nothing changed upstream.

7 packs changed +1061 −130

quarantine-file moves to platform built-in commands; Box and Slack event collectors get fetch fixes

A small, tidy day: 7 packs move on 7 commits, one commit each, with no pack added or withdrawn.
AggregatedScripts (+368/-39) migrates the quarantine-file script to platform built-in commands (#45533).
Two event collectors are fixed: Box (+430/-32) clears a fetch-events Docker script timeout (#45163), and Slack (+206/-43) makes slack-get-events read a date range from its command args instead of last run (#45551).
The rest is upkeep — Docker image bumps in CommonScripts (#45535) and rasterize (#45549), a SyntaxWarning fix in GoogleSheets (#45581), and a field moved in MicrosoftGraphUser (#45569).

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.