Content packs — August 19, 2026

36 files changed, 8562 insertions, 460 deletions — view the commit on the mirror.

Six identity.* modeling-rule PRs land in one day; Orca's event collector fixes pagination

The identity.* modeling-rule series lands in bulk: PRs 1, 2, 4, 5, 6 and 7 of 7 all merge on the same day (#45448, #45565, #45438, #45436, #45437, #45462).
Yesterday’s revert is undone — GuardiCore (+962), Silverfort (+177), CommvaultBackupSolutions (+121) and CitrixADC (+117) regain almost exactly the lines PR 2’s revert removed.
36 packs move and 19 of them are addition-only against a single deleted line; Azure (+1,383) and Orca (+1,160/-242) are the largest.
Two collection fixes land: XDR Collector RFC-3164 syslog now ingests into linux_linux_raw (#45574), and Arista Switch parsing accepts millisecond timestamps (#45571).

Highlights

The reverted identity.* modeling rules return, with a CitrixADC fix attached

PR 2 of 7 re-lands as #45565 carrying a fix for malformed coalesce nesting in CitrixADC_2_11, and the four packs cut back yesterday recover within a line or two of what they lost.
Six of the seven identity.* modeling-rule PRs merge on one day

PRs 1, 2, 4, 5, 6 and 7 land under CRTX-271523, CRTX-271525 and CRTX-271526; only PR 3 is absent from the day's commits.
Orca Event Collector fixes event pagination and cursor handling

At +1,160/-242 it is the day's only substantial rewrite, and it adds an _ENTRY_STATUS field (#45415).
XDR Collector RFC-3164 syslog is ingested into linux_linux_raw

LinuxEventsCollection gains 253 lines against 3 deleted for the new syslog path (#45574).
AWS S3 command context outputs are rewritten

The AWS pack moves +157/-67 updating the context outputs of its S3 commands (#45254) — the largest deletion count of the day outside Orca.
Arista Switch parsing rule accepts millisecond timestamps

A seven-line change adds millisecond timestamp format support to the parsing rule (#45571).

Changes

36 files listed, 15 written up and shaded below.

▸ ▾ AMP modified +134 −1 Packs/AMP

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ AWS modified +157 −67 +157/-67 updating the context outputs of the S3 commands (#45254). Packs/AWS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ AristaSwitch modified +7 −2 Packs/AristaSwitch

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Armis modified +321 −1 Gains 321 lines against a single deletion. Packs/Armis

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Azure modified +1383 −3 The day's largest gain at +1,383 against 3 deleted; a same-day commit adds a check that Azure's yml and py files match (#45420). Packs/Azure

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ BarracudaEmailProtection modified +44 −1 Packs/BarracudaEmailProtection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Base modified +9 −2 Packs/Base

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Box modified +89 −1 Packs/Box

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CaseManagement-Generic modified +49 −10 Packs/CaseManagement-Generic

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CitrixADC modified +117 −1 Packs/CitrixADC

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommunityCommonDashboards modified +19 −4 Packs/CommunityCommonDashboards

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommunityCommonScripts modified +194 −39 +194/-39; no commit subject names the pack. Packs/CommunityCommonScripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommvaultBackupSolutions modified +121 −1 Packs/CommvaultBackupSolutions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Core modified +9 −2 Packs/Core

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CorelightZeek modified +374 −1 Gains 374 lines against a single deletion. Packs/CorelightZeek

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CyberArkEPM modified +281 −1 Gains 281 lines against a single deletion. Packs/CyberArkEPM

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GitHub modified +9 −2 Packs/GitHub

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GoogleDrive modified +74 −1 Packs/GoogleDrive

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GuardiCore modified +962 −1 Gains 962 lines against a single deletion, restoring nearly the 963 lines yesterday's revert removed. Packs/GuardiCore

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ HealthCheck modified +254 −51 +254/-51, one of only four packs with substantial deletions; no commit subject names it. Packs/HealthCheck

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ HuaweiNetworkDevices modified +411 −1 Gains 411 lines against a single deletion. Packs/HuaweiNetworkDevices

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ JamfProtect modified +268 −1 Packs/JamfProtect

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Kubernetes modified +82 −1 Packs/Kubernetes

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ LinuxEventsCollection modified +253 −3 +253/-3 to ingest XDR Collector RFC-3164 syslog into linux_linux_raw (#45574). Packs/LinuxEventsCollection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ McAfeeDatabaseSecurity modified +109 −1 Packs/McAfeeDatabaseSecurity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftDefenderAdvancedThreatProtection modified +9 −2 Packs/MicrosoftDefenderAdvancedThreatProtection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftGraphUser modified +12 −3 +12/-3 under an AUD isolation change dated 2026-08-18 (#45560). Packs/MicrosoftGraphUser

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ NasuniFileServices modified +83 −1 Packs/NasuniFileServices

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Oracle modified +82 −1 Packs/Oracle

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Orca modified +1160 −242 +1,160/-242 for the event collector's pagination and cursor handling fix, plus a new _ENTRY_STATUS field (#45415). Packs/Orca

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ PAN-OS modified +19 −5 Packs/PAN-OS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Silverfort modified +177 −1 Packs/Silverfort

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Slack modified +386 −2 Gains 386 lines against 2 deleted. Packs/Slack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ TrendMicroDeepSecurity modified +621 −1 Gains 621 lines against a single deletion — the largest addition-only pack untouched by yesterday's revert. Packs/TrendMicroDeepSecurity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Whois modified +9 −2 Packs/Whois

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Workday modified +274 −1 Gains 274 lines against a single deletion. Packs/Workday

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.