Content packs — August 12, 2026

15 files changed, 2488 insertions, 132 deletions — view the commit on the mirror.

Six packs get XSIAM 3.19 identity.* modeling rules; MS Graph Security stops mapping every host to the tenant ID

A campaign (CRTX-271523, PRs 1 and 3 of 7) adds a second modeling rule to six packs that mirrors every xdm.*.user.* mapping into xdm.*.identity.*, gated to platform 8.15.0 while the old rule is capped at 8.14.0.
Microsoft Graph Security fixed xdm.source.host.device_id, which was mapped to tenantId and therefore identical on every alert.
Druva gained modeling for Cybersecurity events; PAN-OS added polling to pan-os-platform-get-system-status.
Core removed the SearchIndicatorInEventsAgentix script, superseded by the managed Agentix pack.
SOCRadar and GenericAPICall were Docker image bumps only.

Highlights

Every Microsoft Graph Security alert reported the same device_id

`xdm.source.host.device_id` was mapped to `tenantId` — the Entra tenant, identical across all alerts — and is now `coalesce(deviceEvidence.mdeDeviceId, deviceEvidence.azureAdDeviceId)`, with `xdm.source.host.hostname` newly mapped from `deviceEvidence.hostName`.
identity.* modeling rules ship as parallel 3.19 rule versions, not in-place edits

Each pack keeps its existing rule with a new `toversion: 8.14.0` and adds a `<Pack>_3_19` rule at `fromversion: 8.15.0`, so the identity fields only populate on Cortex XSIAM 3.19 and later.
Druva's schema swapped timeStamp for timestamp and gained a Cybersecurity event set

The modeling rule schema drops `timeStamp` and adds `timestamp` alongside `category`, `details`, `type`, `feature`, `syslogSeverity`, `facility`, `profileID` and `globalID` for the Cybersecurity stream.
Three Agentix actions and a script were removed as capped at 8.13.0

`SearchIndicatorInEventsAgentix` was deleted from Core, and the Base and Core release notes record `SendMail`, `CortexRunXQLQuery` and `CortexCreateAppSecPolicy` as removed in favour of the managed Agentix pack — though those notes are commented out and surface only as "Documentation and metadata improvements".
PAN-OS can now wait for a device to come back up

`pan-os-platform-get-system-status` accepts `polling=true` and polls the target device until its operational mode reads "normal" or the timeout expires.

Changes

15 files listed, 15 written up and shaded below.

▸ ▾ ApiModules modified +106 −5 2.4.39: the same empty-markdown-delimiter fix in SlackUtilsApiModule, which SlackV3 shares. Packs/ApiModules

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ AzureDevOps modified +303 −1 1.4.23: new AzureDevOps_3_19 modeling rule adding xdm.*.identity.* alongside xdm.*.user.*; the existing rule is capped at platform 8.14.0. Packs/AzureDevOps

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Barracuda_Cloudgen_Firewall modified +101 −1 1.0.9: new Barracuda_CGFWModelingRules_3_19 rule adding the xdm.*.identity.* mappings, existing rule capped at 8.14.0. Packs/Barracuda_Cloudgen_Firewall

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Base modified +8 −1 1.42.17: metadata bump recording the removal of the SendMail Agentix Action, capped at platform 8.13.0. Packs/Base

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ BeyondTrustRemoteSupport modified +818 −1 1.0.6: new BeyondTrustRemoteSupport_3_19 modeling rule adding the xdm.*.identity.* mappings, existing rule capped at 8.14.0. Packs/BeyondTrustRemoteSupport

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Core modified +15 −78 3.5.83: deleted the SearchIndicatorInEventsAgentix script, capped at platform 8.13.0 and superseded by the managed Agentix pack. Packs/Core

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CybelAngel modified +242 −1 1.1.11: new CybelAngel_3_19 modeling rule adding the xdm.*.identity.* mappings, existing rule capped at 8.14.0. Packs/CybelAngel

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Druva modified +145 −17 1.3.7: modeling rule and schema extended to cover Druva Cybersecurity events; timeStamp replaced by timestamp. Packs/Druva

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FortinetFortiwebVM modified +395 −1 2.0.20: new FortinetFortiwebVM_3_19 modeling rule adding the xdm.*.identity.* mappings, existing rule capped at 8.14.0. Packs/FortinetFortiwebVM

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GenericAPICall modified +9 −2 1.0.5: Docker bump to demisto/python3:3.12.13.10404775 only. Packs/GenericAPICall

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftGraphSecurity modified +13 −2 2.5.7: device_id remapped from tenantId to deviceEvidence.mdeDeviceId (falling back to azureAdDeviceId), and hostname mapped from deviceEvidence.hostName. Packs/MicrosoftGraphSecurity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ NetmotionVPN modified +78 −1 1.0.6: new NetmotionVPN_3_19 modeling rule adding the xdm.*.identity.* mappings, existing rule capped at 8.14.0. Packs/NetmotionVPN

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ PAN-OS modified +149 −9 2.6.47: pan-os-platform-get-system-status gained polling=true, waiting for the device to reach operational mode "normal" or time out. Packs/PAN-OS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SOCRadar modified +39 −8 2.3.2: Docker bump to demisto/python3:3.12.13.10116658 across all seven SOCRadar integrations. No behaviour change. Packs/SOCRadar

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Slack modified +67 −4 3.8.13: fixed an invalid_blocks error from empty markdown delimiters that could stop Cortex Agentic Assistant approval prompts reaching Slack. Packs/Slack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.