Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering August 31, 2026, 00:00–24:00 UTC · published September 01, 2026 08:19 UTC.

Last checked about 15 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

419 pages changed +1915 −297

Amazon S3 ingestion adds an sqs:GetQueueAttributes prerequisite; 195 licence notes reworded to "connector"

Amazon S3 collection gained a prerequisite: GetQueueAttributes was added to the minimum SQS permissions on all six S3 pages, in the prose and in the sample IAM and queue access policies.
195 licence notes changed “This sub-capability is available…” to “This connector is available…” — a noun swap only; not one entitlement list gained or lost a product.
347 pages gained description front matter, and 59 vendor landing pages that were bare headings now list the articles beneath them.
Everything sits in the Cortex XSIAM data sources and connectors section; 420 files changed, all modifications — nothing added, deleted or renamed.

0 rules changed +0 −0

Synced, and nothing changed upstream.

17 packs changed +34445 −2925

Google SecOps 6.0.0 rewrites the Chronicle pack; a SaaS Claude connector splits into its own pack

GoogleChronicleBackstory added 27,773 lines against 12 removed for “Google SecOps Release 6.0.0” — nine tenths of the day’s churn on its own.
AnthropicClaudeStandardConnector arrives as a new 306-line pack while AnthropicClaude drops 1,821 lines, the two halves of a SaaS connector split.
ApiModules grew by 2,307 lines, the day’s second-largest change.
Integration fixes landed in Mimecast, Doppel, Reco and Akamai_WAF; SpyCloudEnterpriseProtection gained a new data type.
17 packs moved in total, from 12 upstream commits.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.