Content packs — August 05, 2026
9 files changed, 1754 insertions, 64 deletions — view the commit on the mirror.
Cisco Email Threat Defense connector added; AWS CloudWatchLogs marked for deprecation
- Cisco Email Threat Defense (ETD) Cortex XSOAR Connector is a new pack that fetches ETD message events as incidents and ships a reclassification and remediation playbook.
- AWS - CloudWatchLogs carries a deprecation notice for November 2026, pointing users at the unified AWS integration.
- Deprecations landed on two Microsoft commands: the display_name argument of
azure-sentinel-threat-indicator-update, and the filter, select and expand arguments ofazure-sc-list-alert. - Microsoft Sentinel also gained two incident fetch filters, and Amazon Web Services a tags argument on EKS access entry creation.
Highlights
-
Cisco ETD email threats can be ingested and remediated from XSOAR
The pack fetches malicious and suspicious ETD message events as incidents and includes a playbook that reclassifies verdicts and moves messages to quarantine, junk, inbox, trash or delete.
-
AWS - CloudWatchLogs will be deprecated in November 2026
The release note recommends migrating to the unified AWS integration, which covers the same functionality plus broader AWS service support.
-
Microsoft Sentinel can exclude incidents by title and alert product
New *Incident Titles to Not Fetch* and *Alert Product Names to Not Fetch* parameters filter fetched incidents.
-
Two Microsoft command arguments stopped working upstream
Sentinel's API no longer supports updating indicator display names, and Defender for Cloud ignores the alert list filter arguments — use azure-rg-query instead.
Changes
9 files listed, 6 written up and shaded below.
-
▸ ▾ AWS modified +17 −4 Added a tags argument to the aws-eks-access-entry-create command.
Packs/AWSRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ AWS-CloudWatchLogs modified +5 −1 Deprecation notice: the integration will be deprecated in November 2026 in favour of the unified AWS integration.
Packs/AWS-CloudWatchLogsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ApiModules modified +49 −3
Packs/ApiModulesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ AzureSecurityCenter modified +17 −7 Deprecated the filter, select and expand arguments of azure-sc-list-alert, which Defender for Cloud no longer supports; use azure-rg-query to filter alerts.
Packs/AzureSecurityCenterRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ AzureSentinel modified +178 −42 Added Incident Titles to Not Fetch and Alert Product Names to Not Fetch parameters, and deprecated and hid the display_name argument of azure-sentinel-threat-indicator-update.
Packs/AzureSentinelRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommunityElasticSearch modified +9 −2
Packs/CommunityElasticSearchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ETDXsoarConnector modified +1455 −0 New pack: fetches Cisco Email Threat Defense message events as incidents, with an ETD Malicious Email incident type, an ETD Message ID field and a reclassification and remediation playbook.
Packs/ETDXsoarConnectorRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ GoogleDrive modified +7 −1 Binary output from the Google Drive get-file-content command is now tagged ;base64, alongside the shared GoogleDriveApiModule and the Google Drive standard connector.
Packs/GoogleDriveRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ GoogleDriveStandardConnector modified +17 −4
Packs/GoogleDriveStandardConnectorRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.