Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 24, 2026, 00:00–24:00 UTC · published August 25, 2026 03:48 UTC.

Last checked about 23 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

425 pages changed +2652 −1119

Editorial pass over 424 XSIAM pages: 276 gain search descriptions, two lose reference detail

  • 276 pages gained a description frontmatter block and 73 more had theirs rewritten, a metadata pass covering most of the Cortex XSIAM book.
  • Headings and prose were rewritten to name Cortex XSIAM explicitly, and the multi-tenant child tenant pages moved from Incidents and Alerts to Cases and Issues.
  • Two pages lost reference detail: the node icons table in the causality icons key, and the step-by-step rule criteria in Set up case scoring.
  • Twelve stub section pages gained child page indexes, and three pages had collapsible sections flattened into ordinary headings.
  • No page was added, removed or renamed; nine navigation titles changed, but every path stayed put.
  • Navigation manifest (xsiam)
  • Base image rules
  • Create a base image rule
  • Find the base image for an asset
  • Cloud security rules and policies
  • Cloud security policies
  • and 419 more

See what changed →

Analytics rules

0 rules changed +0 −0

Synced, and nothing changed upstream.

Content packs

9 packs changed +1606 −173

Event Collector reliability fixes dominate; USTA deprecated in favour of USTAv4

  • AWS-GuardDuty takes 70% of the day at +1,123/-110, fixing duplicate events and a fetch stall in its Event Collector (#45492).
  • USTA is deprecated and USTAv4 updated in the same commit — the day’s only withdrawal (#45624).
  • Nine packs move for 8 upstream commits, 1,606 lines added against 173 deleted; the snapshot head c9f7d9d is same-day.
  • Ingestion reliability is the theme: GuardDuty, the Okta Event Collector (#45584) and the Strata Logging Service URL fallback (#45568) are three of the four largest packs.
  • Modeling-rule housekeeping continues under CRTX-271523 with a CiscoNexus field-separator fix (#45626).
  • AWS-GuardDuty
  • AWS-SecurityHub
  • CiscoNexus
  • Core
  • CortexDataLake
  • Okta
  • and 3 more

See what changed →

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.