Platform Changes

Everything that moved across Cortex — the documentation, the analytics rules, and the content packs.

Covering September 03, 2026, 00:00–24:00 UTC · published September 04, 2026 07:44 UTC.

Last checked about 11 hours ago. Summaries are written by claude-code/claude-opus-5; the changes themselves are recorded automatically.

Documentation

22 pages changed +102 −91

Tenant users now need a CSP role first; connector consolidation covers only Palo Alto Networks integrations

Manage user access gains a prerequisite: a user must hold the Cortex User role in the Customer Support Portal before they appear in a tenant’s Users list.
Five data source pages narrow the unified connector story to Palo Alto Networks managed integrations — partner-managed and community-contributed packs stay standalone.
Retrieve support file password was rewritten around the two ways a Tech Support File is produced.
Compliance standard cloning changed: copies are suffixed _copy rather than prefixed “Copy of “, and the flow gains a Select Controls step.
The rest is Cortex Cloud → Cortex XSIAM wording fixes, two retitled pages and whitespace.

0 rules changed +0 −0

Synced, and nothing changed upstream.

8 packs changed +18393 −3154

Veeam App v2.0.0 lands; GitHub Feed CIDR truncation and XDR Collector _time parsing fixed

Veeam shipped a v2.0.0 app, 15,708 insertions against 2,302 deletions — larger than the other seven packs of the day combined.
Two ingestion-correctness fixes worth acting on: FeedGitHub was truncating CIDR prefix lengths, and LinuxEventsCollection was setting _time wrongly for XDR Collector logs.
CyberArkEPM moved to a version-less EPM API and fixed set names containing commas.
The rest is fetch reliability and parsing repair in CybleEventsV2, MailListener and HealthCheck.

BIOC rules are not tracked yet — that sync signs in to a live Cortex tenant, so there is nowhere for an unattended daily export to run.