Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 26, 2026, 00:00–24:00 UTC · published August 27, 2026 13:35 UTC.

Last checked about 21 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

447 pages changed +2598 −1395

Container registry scanning regrouped by vendor; Identity Profile version floor drops to XSIAM 3.5

Registry scanning is now licensed by either the Cloud Posture Security or the Cloud Runtime Security add-on, where before only Cloud Runtime Security qualified.
Twelve container registry pages moved out of Cloud Posture and Runtime Security data sources into per-vendor folders under Vendor-specific data sources and connectors.
Identity Profile now names Cortex XSIAM 3.5, Cortex XDR 5.1 or Cortex Cloud Runtime 2.1 instead of a flat XSIAM 3.6 floor, and is explicitly unavailable on XSIAM 2.x and XDR 3.x.
Ubuntu 26 gains supported-kernel pages on x86_64 and aarch64 at agent 9.1.0, alongside newly certified kernels across AlmaLinux, Rocky, RHEL, Oracle, Amazon Linux and Ubuntu.
Most of the day’s 448 files are an editorial pass: 182 XSIAM pages and most of the 75 Development Guide pages had descriptions and headings rewritten without changing meaning.

0 rules changed +0 −0

Synced, and nothing changed upstream.

11 packs changed +2128 −239

A narrow 11-pack day: QRadar rewritten, Microsoft Entra ID nearly doubles in additions

Only 11 packs move for 5 upstream commits — +2,128/-239 — a quarter of the previous day’s pack count.
QRadar (+1,080/-184) and MicrosoftEntraID (+774/-1) are 87% of the day’s insertions between them; everything else is small.
QRadar carries nearly all the day’s deletions, so that pack was rewritten rather than extended; Entra ID is near-pure addition.
Two Slack commits land together: telemetry-failure list messages and an auth_target mapping for event 102.
The identity.* modeling-rule work continues at PR 2 of 7 (CRTX-271527, #45464), a day after PR 1.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.