Content packs — August 09, 2026
12 files changed, 12410 insertions, 873 deletions — view the commit on the mirror.
AWS Security Hub v2 and Intel471 Credentials land; 663 CommonTypes definitions gain module gating
- AWS - Security Hub v2 is a new integration: OCSF-format findings, four
aws-securityhub-v2-*commands, and bidirectional incident mirroring with incoming/outgoing mappers and its own incident type. - Intel471 Credentials is a new integration fetching leaked credentials as one indicator per credential, alongside twelve new Intel471 Info Stealer indicator fields.
- CommonTypes added a
supportedModuleslist to 663 field, classifier and indicator-type definitions —xsiamandagentixthroughout, plusxtion the five core reputation types. - Cyware Intel Exchange (CTIX) 2.5.0 shipped a flagged-indicator deletion job, five new flag fields, and deprecated the older Cyware Threat Intelligence eXchange integration.
- Three authentication and severity-mapping fixes: Defender for Endpoint on GCC High/DoD, Graph Security severity, and CTIX revoked indicators.
Highlights
-
New integration: AWS - Security Hub v2 with bidirectional mirroring
Ingests unified findings in OCSF format via the Security Hub V2 API, adds enable/disable/get/batch-update commands, and mirrors incidents both ways with a Resolve finding of closed incident parameter.
-
New integration: Intel471 Credentials for leaked-credential feeds
Fetches from the Intel471 Credentials API and produces an indicator per credential plus an associated incident, exposed through intel471-credentials-get-indicators.
-
663 CommonTypes definitions are now gated by supported module
Every touched field, classifier and indicator type gained a supportedModules list of xsiam and agentix; the domain, file, ip, ipv6 and url reputation types also list xti.
-
Defender for Endpoint authentication fixed for GCC High and DoD
The OAuth scope used an invalid windowsatpservice resource principal on those endpoint types, failing with resource principal not found in the tenant.
-
CTIX revoked indicators were invisible to Threat Intel queries
The is_revoked flag was not mapped to the CTIX - Is Revoked field; the five new CTIX flag fields were also renamed to a ctix prefix to avoid cliName collisions.
-
Cyware Threat Intelligence eXchange deprecated
The older integration is marked deprecated in favour of Cyware Intel Exchange, which gained a 12-hourly job and playbook for deleting flagged indicators.
Changes
12 files listed, 12 written up and shaded below.
-
▸ ▾ AWS-SecurityHub modified +3363 −1 New AWS - Security Hub v2 integration: OCSF findings, four commands, bidirectional mirroring, mappers and an incident type.
Packs/AWS-SecurityHubRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CTIX modified +974 −87 Added a flagged-indicator deletion script, playbook and 12-hourly job, five ctix-prefixed flag fields, and an is_revoked mapping fix; deprecated Cyware Threat Intelligence eXchange.
Packs/CTIXRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Cisco-umbrella-cloud-security modified +9 −2 Proxy log modeling now maps the most granular identity to xdm.source.user.username for AD Users, and to xdm.source.host.hostname otherwise.
Packs/Cisco-umbrella-cloud-securityRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommonTypes modified +5973 −681 Added supportedModules (xsiam, agentix) to 663 definitions; xti added to the five core reputation indicator types.
Packs/CommonTypesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ EDL modified +37 −26 Documented that each instance uses three consecutive ports and that concurrent requests during cache population return HTTP 429.
Packs/EDLRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ FeedDomainTools modified +144 −44 Switched the feed endpoints to the DomainTools Python Wrapper; Docker image bumped to demisto/vendors-sdk:1.0.0.10470199.
Packs/FeedDomainToolsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ FeedIntel471 modified +1617 −2 New Intel471 Credentials integration for leaked credentials, plus twelve Intel471 Info Stealer indicator fields.
Packs/FeedIntel471Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftDefenderAdvancedThreatProtection modified +115 −13 Fixed the OAuth scope's invalid windowsatpservice resource principal for GCC High and DoD endpoint types.
Packs/MicrosoftDefenderAdvancedThreatProtectionRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftGraphMail modified +53 −4 Added a folder_id argument to msgraph-mail-list-emails and clarified the error when the associated email address is misconfigured.
Packs/MicrosoftGraphMailRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftGraphSecurity modified +26 −5 Fixed Informational incidents being mapped as Unknown severity, and severity input_values/mapped_values in the alert mapper.
Packs/MicrosoftGraphSecurityRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ TAXIIServer modified +19 −1 Documentation and metadata improvements only.
Packs/TAXIIServerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ThreatMon modified +80 −7 Added threatmon_request_data_removal to submit a Black Market Monitoring removal request, checking remaining credits first.
Packs/ThreatMonRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.