Content packs — July 28, 2026

25 files changed, 656 insertions, 90 deletions — view the commit on the mirror.

PAN-OS polling timeouts made configurable; ServiceNow gains note-formatted attachments

PAN-OS made the polling timeout/interval configurable on its content-, antivirus-, WildFire-, and GlobalProtect-update download/install commands, replacing a hardcoded 300s timeout / 10s interval with defaults of 3600s / 30s.
ServiceNow v2 added a Mark attachment as note parameter and an Interpret comments in a specific format parameter (Source, Text, or HTML), plus a Docker image bump.
Microsoft Graph Files (Standard Connector) was un-deprecated (the deprecated: true flag was removed from the integration YAML).
A routine auto-generated Docker image update PR bumped images across 22 unrelated packs (AccentureCTI_Feed, MISP, GitHub, Zabbix, and others) — bookkeeping, not functional change.
Core picked up a release-notes/metadata-only bump (3.5.75 → 3.5.76) from an automated RN sync.

Highlights

PAN-OS polling timeout/interval no longer hardcoded

The eight pan-os-*-latest-*-update download/install commands gained timeout_in_seconds (default 3600) and interval_in_seconds (default 30) arguments, replacing a fixed 300s/10s polling loop.
ServiceNow v2 can mark attachments as notes and format comments

New mark_attachments_as_note and comment_format (Source/Text/HTML) configuration parameters, so a notes filter can surface both comments and attachments.
Microsoft Graph Files (Standard Connector) un-deprecated

The deprecated: true flag was removed from the integration YAML.

Changes

25 files listed, 4 written up and shaded below.

▸ ▾ AccentureCTI_Feed modified +9 −2 Packs/AccentureCTI_Feed

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ AnomaliThreatStreamFeed modified +10 −3 Packs/AnomaliThreatStreamFeed

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Anomali_ThreatStream modified +9 −2 Packs/Anomali_ThreatStream

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ArcherRSA modified +9 −2 Packs/ArcherRSA

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommunityCommonDashboards modified +9 −2 Packs/CommunityCommonDashboards

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommunityCommonScripts modified +7 −2 Packs/CommunityCommonScripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Core modified +13 −3 Automated release-notes/metadata-only version bump (3.5.75 to 3.5.76). Packs/Core

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CyberArkIdentity modified +9 −2 Packs/CyberArkIdentity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CyberX-CentralManager modified +9 −2 Packs/CyberX-CentralManager

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Dropbox modified +9 −2 Packs/Dropbox

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedAlienVault modified +12 −5 Packs/FeedAlienVault

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedGCPWhitelist modified +9 −2 Packs/FeedGCPWhitelist

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedMalwareBazaar modified +9 −2 Packs/FeedMalwareBazaar

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedTAXII modified +9 −2 Packs/FeedTAXII

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GitHub modified +9 −2 Packs/GitHub

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ JARM modified +9 −2 Packs/JARM

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MISP modified +9 −2 Packs/MISP

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftGraphFilesStandardConnector modified +7 −2 Un-deprecated; metadata and documentation improvements. Packs/MicrosoftGraphFilesStandardConnector

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Mimecast modified +9 −2 Packs/Mimecast

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ PAN-OS modified +178 −15 Made polling timeout/interval configurable on content/antivirus/WildFire/GlobalProtect update commands. Packs/PAN-OS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SEKOIAIntelligenceCenter modified +9 −2 Packs/SEKOIAIntelligenceCenter

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ServiceNow modified +247 −20 Added attachment-as-note and comment-format parameters; Docker image bump. Packs/ServiceNow

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SuspiciousDomainHunting modified +29 −6 Packs/SuspiciousDomainHunting

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ThalesCipherTrustManager modified +9 −2 Packs/ThalesCipherTrustManager

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Zabbix modified +9 −2 Packs/Zabbix

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.