Content packs — August 16, 2026
32 files changed, 34685 insertions, 1574 deletions — view the commit on the mirror.
Cyberhaven DLP pack lands at 1.0.0; Elasticsearch v2 gains two-way case and alert mirroring
- 19 commits, 225 files net across 26 packs — one new partner pack, Cyberhaven 1.0.0, for DLP incident fetch and data-lineage investigation.
- Elasticsearch v2 1.6.0 turns into a mirroring integration: two new incident types, four mappers, eight incident fields and the three
*-remote-*commands. - Ten packs each gained a second modeling rule mapping
xdm.*.identity.*alongsidexdm.*.user.*, with the existing rule capped attoversion: 8.14.0. - Microsoft Graph Security 2.6.0 now fetches incidents as well as alerts; Okta Event Collector 3.4.0 retries HTTP 429s.
- Two rounds of Docker base-image bumps (XSUP-74966, XSUP-71787) landed and were reverted the same day — no net change to HealthCheck, GitHub, Defender for Endpoint or ZipFile.
Highlights
-
New pack: Cyberhaven 1.0.0, a partner-supported DLP integration
81 files add the Cyberhaven integration, 46 incident fields (data lineage start/end IDs, policy and dataset metadata, an event lineage graph link), an incoming mapper, a layout, a CyberhavenIncidentRefresh script and a Synchronize Incident Closure playbook; the metadata lists marketplaces xsoar, marketplacev2 and platform, and supported modules agentix and xsiam.
-
Elasticsearch v2 can now mirror cases and security alerts in both directions
New Elasticsearch Case and Elasticsearch Security Alert incident types with incoming and outgoing mappers, a classifier keyed on the integration-set `elastic_entity_kind` field, and parameters for fetch type, mirroring direction, case severity and status filters, and closing the mirrored incident on either side.
-
Ten log sources gained an identity-aware modeling rule for XSIAM 2.11
CRTX-271526 (PRs 1–3 of 7) added a `_2_11` modeling rule to Avaya Aura Communication Manager, Cisco Firepower, Cisco Stealthwatch, Duo Admin API, Juniper SRX, Microsoft DHCP, Office 365, Synopsys Coverity, Ubiquiti UniFi and VMware ESXi, each capping the prior rule at `toversion: 8.14.0` so only one applies per tenant version.
-
Microsoft Graph Security fetches incidents alongside alerts
A Fetch incidents type parameter and a new Graph Security Incident type; the existing filter was renamed Alerts Filter, Max incidents per fetch became Fetch limit per type with a default of 50, and msg-list-security-incident gained an extra_data argument.
-
Both Docker base-image bump batches were reverted the same day
XSUP-74966 (four commits, touching HealthCheck, CommunityCommonScripts, GitHub, Microsoft Defender for Endpoint and others) and XSUP-71787 (ZipFile/UnzipFile) were each reverted within the day, leaving those packs unchanged; only the separate xsoar-tools:1.0.0.11807991 bump in Base, CommonScripts, ContentManagement and SilentPush survived.
-
Okta Event Collector stopped giving up on rate limits
The collector previously stopped retrying after an HTTP 429; 3.4.0 adds automatic retries for rate-limited and transient responses and reworks the event collection mechanism.
Changes
32 files listed, 10 written up and shaded below.
-
▸ ▾ ApiModules modified +83 −7 2.4.40: CoreIRApiModule fix for core-get-script-execution-result-files failing to retrieve the results file on Cortex XSIAM tenants.
Packs/ApiModulesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ AtlassianConfluenceCloud modified +7 −2 1.1.17: the parsing rule no longer fails with an invalid named capture error when a changedValues field name contains a dot.
Packs/AtlassianConfluenceCloudRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ AvayaAuraCommunicationManager modified +163 −1
Packs/AvayaAuraCommunicationManagerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Base modified +11 −11
Packs/BaseRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CaseManagement-Generic modified +59 −59
Packs/CaseManagement-GenericRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CiscoFirepower modified +185 −1
Packs/CiscoFirepowerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CiscoStealthwatch modified +93 −1
Packs/CiscoStealthwatchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommonScripts modified +16 −16
Packs/CommonScriptsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommunityCommonDashboards modified +23 −23
Packs/CommunityCommonDashboardsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommunityCommonScripts modified +233 −233
Packs/CommunityCommonScriptsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Core modified +15 −1 3.5.84: picks up the same core-get-script-execution-result-files fix for XSIAM tenants in Investigation & Response.
Packs/CoreRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CortexXDR modified +7 −1
Packs/CortexXDRRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CrowdStrikeFalcon modified +176 −373 2.12.8: the Test button now reports a clear message instead of a raw connection error when the server is unreachable.
Packs/CrowdStrikeFalconRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Cyberhaven modified +25263 −0 New partner pack 1.0.0: DLP incident fetch from the Cyberhaven platform, 46 incident fields, an incoming mapper, a layout, a refresh script and a closure-sync playbook.
Packs/CyberhavenRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ DuoAdminApi modified +230 −1
Packs/DuoAdminApiRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Elasticsearch modified +2588 −7 1.6.0: adds Elasticsearch Case and Security Alert incident types, four mappers, eight incident fields, a classifier and full incident mirroring in Elasticsearch v2.
Packs/ElasticsearchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ GitHub modified +11 −11
Packs/GitHubRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ HealthCheck modified +305 −305
Packs/HealthCheckRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ JuniperSRX modified +141 −1
Packs/JuniperSRXRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftDHCP modified +72 −1
Packs/MicrosoftDHCPRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftDefenderAdvancedThreatProtection modified +11 −11
Packs/MicrosoftDefenderAdvancedThreatProtectionRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftGraphSecurity modified +612 −99 2.6.0: fetches incidents in addition to alerts, adds an Incidents Filter and a Graph Security Incident type, and fixes odata not being passed as a raw $filter.
Packs/MicrosoftGraphSecurityRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftGraphUser modified +11 −11
Packs/MicrosoftGraphUserRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Office365 modified +1137 −1
Packs/Office365Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Okta modified +1917 −363 3.4.0: automatic retries for rate-limited and transient API responses; the collector no longer stops retrying after an HTTP 429.
Packs/OktaRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ SilentPush modified +25 −13 2.0.3: the Test button validates the response payload rather than the HTTP status code, a missing API Key now errors clearly, and Threat Check Access Key was renamed.
Packs/SilentPushRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ SynopsysCoverity modified +80 −1
Packs/SynopsysCoverityRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ThreatMon modified +14 −6 1.0.6: threatmon_update_incident_status no longer fails with "Failed to parse json object from response" when the API returns an empty body on success.
Packs/ThreatMonRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ UbiquitiUnifi modified +140 −1
Packs/UbiquitiUnifiRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ VMwareESXi modified +1039 −1
Packs/VMwareESXiRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Whois modified +11 −11
Packs/WhoisRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ctf01 modified +7 −1
Packs/ctf01Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.