Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering September 02, 2026, 00:00–24:00 UTC · published September 03, 2026 07:48 UTC.

Last checked about 12 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

6 pages changed +77 −122

Azure agentless disk scanning drops from six custom RBAC roles to three; compliance authoring reworked

  • Microsoft Azure provider permissions replaces the six ADS custom RBAC roles with three, confining every write and delete to the Cortex-created resource group.
  • Three compliance catalog pages rewrite custom standard authoring: categories and controls are no longer built inside the standard wizard, and a control may now belong to more than one custom standard.
  • The Azure APIM ingestion page drops a duplicated inbound policy snippet.
  • The Threat Management landing page gains a link to an Extended Threat Intelligence section.
  • A quiet day otherwise: six pages changed, nothing added or removed.
  • Choose compliance standards from the compliance catalog
  • Use a built-in or custom control
  • Use a built-in or custom standard
  • Ingest Azure APIM
  • Microsoft Azure provider permissions
  • Threat management

See what changed →

Analytics rules

0 rules changed +0 −0

Synced, and nothing changed upstream.

Content packs

37 packs changed +6365 −1599

Microsoft Teams moves to a new standard-connector pack; the identity.* modeling-rule sweep finishes

  • MicrosoftGraphTeams loses 732 lines against 12 added while a new MicrosoftGraphTeamsStandardConnector pack appears at +287/-0 — the day’s one structural move.
  • The identity.* modeling-rule series ends: PR 7 of 7 lands for both CRTX-271525 and CRTX-271527, alongside PRs 3, 5 and 6.
  • 25 of the 37 packs added lines against exactly one deletion each, that sweep’s signature shape.
  • Five substantive fixes landed — Bitbucket authentication, Microsoft Defender for Cloud Apps watermarking, Elasticsearch Kibana URL, Zscaler 401 handling, and an Enterprise DLP argument.
  • 37 packs, 6,365 lines added against 1,599 removed, from 15 upstream commits.
  • Absolute
  • Akamai_SIEM
  • ApiModules
  • Armis
  • AzureEventsHub
  • Bitbucket
  • and 31 more

See what changed →

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.