Content packs — July 27, 2026
2 files changed, 14109 insertions, 7 deletions — view the commit on the mirror.
New Vega integration pack added; FortiGate modeling rule crash fixed
A quiet day: one new pack and one bug fix.
- Vega is a new integration pack that ingests alerts and incidents from the Vega platform, with dedicated incident/alert fields for detections, MITRE ATT&CK mapping, verdicts, and an external-IP enrichment playbook.
- FortiGate’s modeling rule crashed when
saddrheld an address-object name with an embedded IP (e.g.Ransom_140.88.40.4) instead of a bare IP, raising “is not a valid IP address” inincidr(). The rule now extracts the embedded IP before evaluating it.
Highlights
-
New pack: Vega
Ingests alerts and incidents from the Vega platform, including MITRE ATT&CK tactics/techniques, verdicts, and a generic external-IP enrichment playbook.
-
FortiGate modeling rule no longer crashes on address-object saddr values
Address-object names containing an embedded IP (e.g. Ransom_140.88.40.4) previously reached incidr() unparsed and threw an error; the IP is now extracted first and still mapped.
Changes
2 files listed, 2 written up and shaded below.
-
▸ ▾ FortiGate modified +13 −7 Fixed a modeling rule crash on non-standard IPv4 saddr values (address-object names with an embedded IP).
Packs/FortiGateRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Vega modified +14096 −0 New pack: ingests alerts and incidents from the Vega platform into Cortex XSOAR.
Packs/VegaRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.