Content packs — July 30, 2026

10 files changed, 6780 insertions, 1776 deletions — view the commit on the mirror.

New Binalyze AIR Extended forensics pack; Reco 1.8.0 migrates to the External API

Binalyze AIR Extended is a new community-supported pack: 28 binalyze-air-* commands covering forensic acquisition, triage rules, cases, tasks, repositories and endpoint isolation.
Reco 1.8.0 migrated alert, identity, app, file and label commands to the Reco External API and added 14 new list commands taking SCIM v2 filter expressions.
Reco’s Risk level fetch parameter changed meaning: it now fetches the given severity and above rather than an exact match, so existing instances will ingest more alerts.
Slack v3 fixed SlackBlockBuilder and SlackAsk failing inside a Cortex Platform Case War Room, where investigation IDs take the form INCIDENT-<n>.
HPE Aruba Central added an authentication-method choice, and Feedly, Flashpoint, ThreatQ and ReadQRCode took targeted fixes.

Highlights

New pack: Binalyze AIR Extended for DFIR orchestration

A community-supported pack adding 28 commands for endpoint forensic acquisition, triage rule management, case and task operations, repositories and isolation.
Reco's Risk level fetch parameter is no longer an exact match

Setting it to MEDIUM now also returns HIGH and CRITICAL alerts, changing what existing instances ingest without any configuration change.
Reco migrated to the External API and gained 14 commands

Alert, identity, app, file and label commands now use the External API with 429 retry and exponential backoff; pre-migration output field names are still populated for backward compatibility.
Slack entitlements broke in Cortex Platform Case War Rooms

SlackBlockBuilder failed with invalid_blocks_format and SlackAsk replies were not routed back when the investigation ID was of the form INCIDENT-<n>.
HPE Aruba Central Event Collector can authenticate two ways

A new Authentication Method parameter selects between pasting the Access Token JSON and Basic Auth with Username, Password and Customer ID.
ReadQRCode failed on FIPS-enabled environments

Fixed alongside a Docker image bump to demisto/qrcode:1.0.0.11449351.

Changes

10 files listed, 10 written up and shaded below.

▸ ▾ BinalyzeAIRExtended modified +2657 −0 New community pack with 28 binalyze-air-* commands for forensic acquisition, triage, cases, tasks, repositories and isolation. Packs/BinalyzeAIRExtended

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CloudSecurityPostureManagement modified +2 −1 Secrets-ignore lint configuration only; no functional change. Packs/CloudSecurityPostureManagement

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommonScripts modified +9 −2 Fixed ReadQRCode failing on FIPS-enabled environments; Docker image bump. Packs/CommonScripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CortexResponseAndRemediation modified +4 −1 Automated release-note sync; documentation and metadata improvements only. Packs/CortexResponseAndRemediation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedFeedly modified +63 −2 Fixed the instance-level Tags configuration not being applied to ingested indicators; Docker image bump. Packs/FeedFeedly

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Flashpoint modified +150 −31 Improved resource URL generation so vulnerability and report alerts fetch successfully; Docker image bump. Packs/Flashpoint

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ HPEArubaCentral modified +869 −75 Added an Authentication Method parameter offering Access Token JSON or Basic Auth with Customer ID. Packs/HPEArubaCentral

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Reco modified +2980 −1657 Migrated to the Reco External API with 429 retry, added 14 SCIM-filtered list commands, and changed Risk level to severity-and-above. Packs/Reco

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Slack modified +35 −4 Fixed SlackBlockBuilder invalid_blocks_format and unrouted SlackAsk replies for INCIDENT-<n> Case War Room ids. Packs/Slack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ThreatQ modified +11 −3 Fixed Python 2-style artifacts that raised a SyntaxError; the integration remains deprecated. Packs/ThreatQ

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.