Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 27, 2026, 00:00–24:00 UTC · published August 28, 2026 14:54 UTC.

Last checked about 19 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

107 pages changed +767 −508

Cloud posture onboarding pages retire into the vendor tree; new DSPM Database applet page

A new Activate DSPM Database page documents a Broker VM applet that connects to on-premise PostgreSQL and MySQL databases to classify content and report risk.
Six onboarding pages under Cloud Posture and Runtime Security data sources were deleted; that section now has no child pages and its parent links out to the vendor-tree copies instead.
Activate Registry Scanner turned twelve broken-reference placeholders into working links, while two other pages regressed the other way.
All 86 vendor landing pages gained a “Here are the articles in this section” index, and their descriptions now say “connector” where they said “integration”.
Nine Extended Threat Intelligence pages changed their description frontmatter only — no body text moved.

0 rules changed +0 −0

Synced, and nothing changed upstream.

222 packs changed +10921 −6078

A 222-pack metadata sweep: supportedModules lands on existing fetch-incidents params

222 packs move for 7 upstream commits (+10,921/-6,078). No pack was added or removed.
Two of those commits are phases 1 and 2 of one supportedModules sweep over existing Fetch Incidents parameters (CIAC-17795) — the only change large enough to explain a pack count this high.
The day is mostly metadata: 196 of the 222 packs delete 3 lines or fewer, and 179 change 30 lines or fewer in total.
Two thirds of the 16,999 changed lines sit in seven packs whose insertions and deletions nearly cancel — IronPort, Gem, DatadogCloudSIEM, DataBee, Sysdig, DigitalShadows and Orca.
The remaining five commits are product fixes: xdr-xql-generic-query arguments, Intune timestamp parsing, Netskope network-event mapping, and two KeyError fixes.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.