Content packs — July 29, 2026
13 files changed, 2383 insertions, 93 deletions — view the commit on the mirror.
CrowdStrike Falcon event fetching restricted to XSIAM tenants; F5 BIG-IP iRule HTTP logs supported
- CrowdStrike Falcon fixed ingestion latency when fetching events, and limited event fetching to Cortex Platform tenants with the XSIAM module — it is no longer available on EDR, Cloud, or Cloud Runtime Security tenants.
- F5 BIG-IP LTM added parsing and modeling support for iRule HTTP access logs (
ir-log_http), a new log source with client- and server-side connection details. - AWS gained three Network Firewall subnet commands: associate, disassociate, and subnet-change-protection update.
- A
FormatURLbug that mangled percent-encoded spaces — corrupting indicator extraction — was fixed in both the script and the shared API module. - The rest of the day is fixes: Elasticsearch fetch parsing, Netcraft lookback, PAN-OS job polling, and similar-incident hyperlinks on XSOAR 8.x.
Highlights
-
CrowdStrike Falcon event fetching now requires the XSIAM module
Fetching events is available only on Cortex Platform tenants with the Cortex XSIAM module, and no longer on tenants with the EDR, Cloud, or Cloud Runtime Security modules.
-
F5 BIG-IP iRule HTTP access logs are a new supported source
Both the parsing rule and the modeling rule added ir-log_http, mapping client-side and server-side connection details.
-
FormatURL corrupted URLs containing spaces
Percent-encoded spaces were decoded to literal spaces and URLs with literal spaces were dropped, producing invalid URLs and wrong indicator extraction; spaces are now consistently kept as %20.
-
AWS Network Firewall subnet association commands added
aws-network-firewall-subnets-associate, -subnets-disassociate, and -subnet-change-protection-update, each documented with its required IAM permission.
-
Similar-incident links broke on Cortex XSOAR 8.x
DBotFindSimilarIncidents generated legacy hash-based hyperlinks (#/Details/ID) that redirected to the dashboard; links now use the correct format per version.
Changes
13 files listed, 13 written up and shaded below.
-
▸ ▾ AWS modified +1101 −19 Added three Network Firewall commands for associating, disassociating, and change-protecting firewall subnets.
Packs/AWSRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ApiModules modified +56 −2 Same %20 preservation fix applied in FormatURLApiModule.
Packs/ApiModulesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ BarracudaWAF modified +11 −5 Fixed resource fields being mis-parsed when the log contained extra whitespace or values with spaces.
Packs/BarracudaWAFRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Base modified +68 −3 DBotFindSimilarIncidents no longer emits legacy hash-based hyperlinks that redirected to the dashboard on XSOAR 8.x.
Packs/BaseRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommonScripts modified +7 −1 FormatURL now preserves %20 instead of decoding it, and no longer drops URLs containing literal spaces.
Packs/CommonScriptsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Core modified +8 −1 core-script-run now processes multiple endpoint IDs in one command instead of one command per endpoint.
Packs/CoreRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CrowdStrikeFalcon modified +146 −11 Fixed event-fetch ingestion latency; event fetching restricted to Cortex Platform tenants with the XSIAM module.
Packs/CrowdStrikeFalconRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ DemistoRESTAPI modified +241 −5 UploadFile gained a retry mechanism with exponential backoff for transient upload failures.
Packs/DemistoRESTAPIRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Elasticsearch modified +71 −3 Fixed fetch-incidents failing with a ParsingException when Fields to Fetch was left empty; Docker image bump.
Packs/ElasticsearchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ F5LTM modified +34 −15 Added parsing and modeling support for F5 BIG-IP iRule HTTP access logs (ir-log_http).
Packs/F5LTMRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Netcraft_V2 modified +424 −20 Added a look-back-minutes fetch parameter and a netcraft-get-incidents command filtered by id; Docker image bump.
Packs/Netcraft_V2Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ PAN-OS modified +201 −5 Added native polling to pan-os-platform-get-jobs for a single job id, polling until status FIN or timeout.
Packs/PAN-OSRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ RubrikPolaris modified +15 −3 Maintenance and stability enhancements only.
Packs/RubrikPolarisRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.