Content packs — August 04, 2026
4 files changed, 1375 insertions, 12 deletions — view the commit on the mirror.
TXOne StellarOne parsing and modeling rules added; Salesforce gains file and Knowledge commands
- TXOne StellarOne is a new XSIAM-only pack: parsing and modeling rules for OT endpoint security logs collected over syslog through the Broker VM.
- Salesforce 2.2.0 added five commands covering file deletion, public links and Knowledge article lifecycle, and made Credentials optional for unified-connector instances.
- Rapid7 InsightVM no longer times out mid-stream on large
fetch-assetsreport downloads. - A quiet day otherwise: four packs moved in total, with no Docker bump.
Highlights
-
TXOne StellarOne logs can now be modeled in XSIAM
Parsing and modeling rules cover audit, system, console and agent (StellarProtect) events forwarded in CEF, queryable as the txone_stellarone_raw dataset.
-
Salesforce added Knowledge article archive and draft commands
salesforce-knowledge-article-archive and salesforce-knowledge-article-draft-create wrap the standard archiveKnowledgeArticles and createDraftFromOnlineKnowledgeArticle actions, the latter unpublishing the online version by default.
-
Salesforce Credentials became optional for unified-connector instances
UCP-managed instances resolve the access token at runtime and were being rejected during pre-execution config validation as missing required config values.
-
Rapid7 InsightVM fetch-assets survives large reports
The report download stream was cut off after five minutes; it now uses an idle-read timeout with no overall limit, so a large report completes in one run.
-
ASM stopped offering a remediation it could not perform
The Cortex ASM - Remediation Path Rules playbook offered *Restrict Open Ports* even when on-prem enrichment had not identified a firewall rule to update.
Changes
4 files listed, 4 written up and shaded below.
-
▸ ▾ CortexAttackSurfaceManagement modified +38 −1 Cortex ASM - Remediation Path Rules no longer offers Restrict Open Ports when on-prem enrichment did not identify a firewall rule to update.
Packs/CortexAttackSurfaceManagementRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Rapid7_Nexpose modified +228 −7 Fixed fetch-assets failing on large reports after a five-minute stream cutoff, added the underlying error type to streaming failure messages, and logged received line counts.
Packs/Rapid7_NexposeRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Salesforce modified +705 −4 2.2.0 added file delete, public link list and remove, and Knowledge article archive and draft-create commands; the Credentials parameter is now optional.
Packs/SalesforceRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ TXOneStellarOne modified +404 −0 New XSIAM pack: parsing and modeling rules for TXOne StellarOne OT endpoint audit, system, console and agent logs ingested via the Broker VM as txone_stellarone_raw.
Packs/TXOneStellarOneRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.