Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 25, 2026, 00:00–24:00 UTC · published August 26, 2026 03:54 UTC.

Last checked about 22 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

187 pages changed +899 −5183

The duplicate SaaS Security tree was deleted — 64 pages gone and its app connection links left broken

64 pages were deleted: the entire SaaS Security sub-book nested under Cloud AI Security, a duplicate of the surviving top-level tree. The Cortex XSIAM book drops from 2,283 to 2,219 pages.
Five SaaS Security index pages now point at broken-reference instead of the deleted copies — including the SaaS app connection table, where roughly forty per-app onboarding links are dead.
Cloud security gained an Attack Path (Legacy) rule type: the rule table entry and the page title were both relabelled.
The Cortex CLI docs were restructured: connect-cortex-cli dropped its inline install instructions for links to existing subpages, and new SCA runtime requirements (Node.js v22+ plus a per-ecosystem toolchain) were documented.
“Cortex Cloud AI Security” became “Cloud AI Security” throughout, and every AI Security licence hint was condensed to name the same three entitlements in one line.

0 rules changed +0 −0

Synced, and nothing changed upstream.

42 packs changed +3077 −328

A broad 42-pack day of additions: AWS, Okta, Netskope and ApiModules lead

42 packs move for 15 upstream commits — 3,077 lines added against 328 deleted, so a day of new material rather than rewrites.
AWS (+647/-161), Okta (+453/-1), Netskope (+332/-13) and ApiModules (+270/-5) are over half the day’s insertions between them.
Three integration fixes land on auth and request handling: OpenAI, ThreatConnect and GitHub.
Fifteen packs each gained an identical 10-line block, matching the day’s “Add License Requirements section to readme” commit (#45591).
Modeling-rule work continues: identity.* fields are added as the first of seven planned PRs (CRTX-271527, #45463).

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.