← Platform Changes

Content packs — July 26, 2026

10 files changed, 7740 insertions, 692 deletions — view the commit on the mirror.

ThreatMon adds a Threat Feed pack and CVE commands; Sysdig ships a breaking v2.0.0 rewrite

A mix of real integration work landed alongside a large [AUD Isolation] PaloAltoNetworks_IoT bookkeeping commit that re-added ~82,000 files across virtually every pack in the catalog — that commit is a repository snapshot from an internal isolation/build process, not a day of content change, and is excluded from the detail below.

  • ThreatMon shipped a new ThreatMon Threat Feed pack, and the base ThreatMon integration gained threatmon_list_cves and threatmon_list_subscribed_cves commands.
  • Sysdig cut a breaking v2.0.0: the incoming mapper was rewritten for the real Secure V2 webhook payload (the old mapper targeted fields that didn’t exist), 34 new incident fields were added, and execute-response-action now supports all 24 response action types with per-action validation. Agent ID/Customer ID are no longer supplied by the webhook and must be resolved via a new sysdig-agent-info-get command.
  • GravityZone’s gz-endpoint-list command gained recursive listing across managed companies plus new filters and output fields.
  • Anthropic Claude integration added claude-chat-file-delete and claude-project-document-delete commands.
  • Doppel fixed duplicate incident creation in fetch-incidents (now paginated and de-duplicated by alert ID) and switched to the API’s max page size.
  • Cybersixgill Actionable Alerts moved case-details/alert-info URL construction into integration code and appended the organization ID as a query parameter.
  • Microsoft Entra ID parsing rule added a time field fallback for events missing TimeGenerated.
  • Base pack bumped Docker images for GetMLModelEvaluation, DBotPredictPhishingWords, and GetIndicatorsByQuery.

Highlights

Changes

10 files listed, 9 written up and shaded below.