Content packs — August 11, 2026

24 files changed, 3400 insertions, 249 deletions — view the commit on the mirror.

Horizon3.ai NodeZero pack added; Akamai WAF SIEM splits incident and event fetch limits

NodeZero 1.0.0 is a new partner pack from Horizon3.ai that fetches high and critical weaknesses from autonomous pentest operations as incidents.
Akamai WAF SIEM 1.3.0 is a flagged breaking change: the Fetch limit parameter was renamed and split into separate incident and event limits, and Akamai Page size was removed.
Amazon Web Services 2.6.0 added aws-s3-bucket-objects-list-v2, built on the ListObjectsV2 API.
Two small fixes: PAN-OS job polling stopping early, and a stray space in a GCP context output.
An automated Docker bump touched 18 packs.

Highlights

NodeZero joins the catalog as a partner-supported vulnerability management pack

The integration fetches HIGH and CRITICAL weaknesses from Horizon3.ai pentest operations, with incident fields for attack path count, weakness score, proof status, CISA KEV listing and ransomware use.
Akamai WAF SIEM fetch limits are a breaking change

*Fetch limit* became *Incident fetch limit* (`fetchLimit`, max 2000) and now governs incidents only, while a new *Events fetch limit* (`eventsFetchLimit`, default 60000, max 80000) governs event collection.
Akamai page size is no longer configurable

The **Akamai Page size** parameter was removed and the page size is now managed internally by the integration.
A second S3 object listing command sits alongside the original

`aws-s3-bucket-objects-list-v2` returns a pagination token for truncated results even when no delimiter is set, which the existing `aws-s3-bucket-objects-list` does not.
Cortex Core IOC documents that enable and disable are TIM-only

The integration YAML and README now state that enabling or disabling an indicator applies only to TIM-managed indicators.

Changes

24 files listed, 6 written up and shaded below.

▸ ▾ AWS modified +318 −1 Added aws-s3-bucket-objects-list-v2, which lists up to 1,000 objects using the ListObjectsV2 API and always returns a pagination token for truncated results. Packs/AWS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Akamai_SIEM modified +322 −144 1.3.0 breaking change: incident and event fetch limits separated into Incident fetch limit and Events fetch limit, Akamai Page size removed, and the event collection flow refactored. Packs/Akamai_SIEM

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CertStream modified +9 −2 Packs/CertStream

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommunityCommonScripts modified +9 −2 Packs/CommunityCommonScripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ContentManagement modified +24 −5 Packs/ContentManagement

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Core modified +21 −11 Indicators detection now documents that enable and disable apply only to TIM-managed indicators. Packs/Core

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CovalenceForSecurityProviders modified +9 −2 Packs/CovalenceForSecurityProviders

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ EmailCommunication modified +9 −2 Packs/EmailCommunication

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedAzureADConnectHealth modified +9 −2 Packs/FeedAzureADConnectHealth

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedDHS modified +9 −2 Packs/FeedDHS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedMicrosoftIntune modified +9 −2 Packs/FeedMicrosoftIntune

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FeedZoom modified +9 −2 Packs/FeedZoom

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GCP modified +490 −2 Fixed an extra space in the context output of gcp-compute-network-tag-set. Packs/GCP

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Nmap modified +9 −2 Packs/Nmap

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ NodeZero modified +1919 −0 New partner pack (Horizon3.ai, 1.0.0): fetches high and critical NodeZero pentest weaknesses as incidents, with a classifier, mapper, seven incident fields and a NodeZero Weakness incident type. Packs/NodeZero

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ PAN-OS modified +102 −27 Fixed pan-os-platform-get-jobs stopping polling prematurely when status or job_type were passed together with id and polling=true. Packs/PAN-OS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ PaloAltoNetworksAutomaticSLR_Community modified +9 −2 Packs/PaloAltoNetworksAutomaticSLR_Community

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ PopularCybersecurityNews modified +21 −6 Packs/PopularCybersecurityNews

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Symantec_Messaging_Gateway modified +48 −23 Packs/Symantec_Messaging_Gateway

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Tufin modified +9 −2 Packs/Tufin

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Use_Case_Builder modified +9 −2 Packs/Use_Case_Builder

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ WebScraper modified +9 −2 Packs/WebScraper

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Workday modified +9 −2 Packs/Workday

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ jamf modified +9 −2 Packs/jamf

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.