Content packs — August 06, 2026
7 files changed, 1373 insertions, 123 deletions — view the commit on the mirror.
Brandefense DRPS joins the catalog; EWS Online Powershell v3 gains transport rule commands
- Brandefense Digital Risk Protection Services 1.0.0 is a new partner pack: a threat intelligence integration with two incident types, eleven incident fields, a classifier and a mapper.
- EWS Extension Online Powershell v3 added
ews-mail-flow-rule-createandews-mail-flow-rule-update, and pinned its EXO Docker version around a Microsoft bug. - Arista Switch fixed ACL modeling for
%ACL-6-IPACCESSevents that carry no interface token, which had been shifting every field one position. - Fixes elsewhere: CrowdStrike Falcon ODS/OFP mirroring, Magnet Automate’s API base path, the generic account enrichment playbook, and a HealthCheck script crash.
- A quiet day otherwise — eight packs, no removals.
Highlights
-
Brandefense Digital Risk Protection Services is a new partner pack
A Brandefense-supported threat intelligence integration (min server 6.10.0) shipping Brandefense Incident and Brandefense Intelligence incident types, eleven incident fields, two layouts, a classifier and an incoming mapper, published to xsoar, marketplacev2 and platform.
-
Arista ACL events without an interface were parsed one field out of place
The rule split the log into a positional `acl_tuple`, so an `%ACL-6-IPACCESS` message missing the interface token pushed the action into the interface slot; named regex extractions now supply `acl_name`, action, protocol and interface whether or not the interface is present.
-
Exchange Online can now create and modify mail flow rules
`ews-mail-flow-rule-create` and `ews-mail-flow-rule-update` add transport rule management to EWS Extension Online Powershell v3.
-
CrowdStrike ODS and OFP detections were mirrored in as generic endpoint detections
Detections with `product=epp` were classified as Endpoint Detection incidents during incoming mirroring rather than as On-Demand Scan or OFP detections.
-
Magnet Automate Beta was calling the wrong endpoints entirely
Requests omitted the `/api/v0` base path, five commands sent no request body, and `mf-automate-workflow-run-cancel` posted to an incorrect endpoint.
Changes
7 files listed, 7 written up and shaded below.
-
▸ ▾ AristaSwitch modified +16 −6 1.0.9: ACL modeling handles %ACL-6-IPACCESS events with no interface token, so action, protocol and interface map correctly either way.
Packs/AristaSwitchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommonPlaybooks modified +65 −3 2.8.7: Account Enrichment - Generic v2.1 no longer passes a placeholder "N/A" or empty username to enrichment commands.
Packs/CommonPlaybooksRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CrowdStrikeFalcon modified +19 −10 2.12.6: ODS and OFP detections with product=epp are no longer misclassified as generic Endpoint Detection incidents during incoming mirroring.
Packs/CrowdStrikeFalconRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ HealthCheck modified +213 −11 3.1.4: HealthCheckIncidentTypes no longer fails with KeyError: 0, and gains its first test file.
Packs/HealthCheckRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MagnetForensics modified +55 −45 1.0.1: restored the /api/v0 base path, added missing request bodies on five commands, and corrected the workflow-run-cancel endpoint.
Packs/MagnetForensicsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftExchangeOnline modified +886 −18 1.10.7 added ews-mail-flow-rule-create and ews-mail-flow-rule-update; 1.10.6 pinned the pwsh-exchangev3 image over a Microsoft bug causing GetResponseHeader failures.
Packs/MicrosoftExchangeOnlineRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ RubrikPolaris modified +119 −30 1.9.2: Rubrik Object Location extended to the Rubrik Radar incident type, surfaced on the Radar layout and populated with the full object path by the context analysis playbook.
Packs/RubrikPolarisRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.