Content packs — August 10, 2026

101 files changed, 5883 insertions, 551 deletions — view the commit on the mirror.

Eight new AWS Network Firewall commands; SOC Framework Pack Manager 1.1.0 reworks pack installation

Amazon Web Services 2.5.0 added eight aws-network-firewall-* commands covering resource policies, resource tagging and logging configuration.
SOC Framework Pack Manager 1.1.0 now upgrades packs in place instead of installing each release as a separate pack, adds a diagnose action, and no longer needs the XSIAMContentPackInstaller automation.
Three ingestion and mirroring fixes: CrowdStrike Falcon event fetch past 10,000 records, SplunkPy v2 mirror-out to Splunk Enterprise Security 8.2.x, and Microsoft Defender for Cloud Apps dropping low-volume event types.
Cloud Posture remediation content moved off the deprecated azure-nsg-* and azure-disk-* commands onto the new azure-vn-* and azure-compute-* names.
An automated Docker bump touched 85 packs, and eight core packs were re-released as dependency locks with no functional change.

AWS gains resource-policy, tagging and logging commands for Network Firewall

Six commands manage resource policies and tags on rule groups and firewall policies, and two describe or update a firewall's logging configuration.
SOC Framework Pack Manager stopped installing every release as its own pack

It also stripped a trailing non-version component from pack names such as soc-v3-tools, installing them under the wrong pack ID, and compared pre-release suffixes so 1.0.6-pr1008 ranked above 1.0.7.
CrowdStrike Falcon event fetch failed beyond 10,000 records

Fetching events errored with "offset + limit must be less than or equal to 10000".
SplunkPy v2 mirror-out to Splunk Enterprise Security 8.2.x fixed

The outgoing finding mapper was updated for 8.2.x, and the processed-mirrored-events cache made concurrency-safe so parallel executions no longer overwrite each other's integration context.
Cloud Posture playbooks moved to the new Azure command names

NSG remediation now calls azure-vn-security-rule-* and the public-access auto-remediation calls azure-compute-disk-update; the rule creation argument action was renamed access.
Active Directory Query v2 can write binary attribute values

A new optional attribute-type argument adds Octet String support to ad-update-user, ad-update-contact and ad-update-group.

101 files listed, 10 written up and shaded below.

▸ ▾ rasterize modified +4 −1 Packs/rasterize

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.