Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering September 01, 2026, 00:00–24:00 UTC · published September 02, 2026 07:37 UTC.

Last checked about 13 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

99 pages changed +429 −159

MongoDB Atlas (Posture) onboarding added; the Cloud Posture source list grows to about 100 connectors

A new MongoDB Atlas (Posture) onboarding page lands, and the Cloud Posture and Runtime Security source list expands from 9 entries to roughly 100.
Twelve Analytics pages move out of Analytics overview to sit directly under Analytics, breaking existing links to the old paths.
ITDR deployment gains a required CyberArk ISP step, and compute units are now documented as consumed by XQL queries only.
27 Linux kernel support pages gain 96 kernel builds between them, with none withdrawn.
Around 30 data source pages get description-only rewording from “data sources” to “data source and connectors”, plus a handful of typo fixes.

0 rules changed +0 −0

Synced, and nothing changed upstream.

30 packs changed +6177 −96

An identity.* modeling-rule sweep touches 26 packs; Flashpoint 2.2.4 is the day's one real release

Six of the day’s ten upstream commits are the same sweep — CRTX-271525 and CRTX-271527, “add identity.* to modeling rules”, PRs 2 through 6 of 7.
26 of the 30 packs that moved added lines against exactly one deletion each, the shape of that sweep: new modeling-rule content plus a version bump.
Flashpoint 2.2.4 is the exception and the largest change, +1,629/-60.
Three genuine fixes landed: MailListener - POP3 date parsing, XSOARmirroring re-enabling get-modified-remote-data, and a reset/refresh-token ordering fix.
30 packs in total, 6,177 lines added against 96 removed.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.