Content packs — August 23, 2026

20 files changed, 8588 insertions, 2452 deletions — view the commit on the mirror.

ThreatZone rewritten in a 20-pack day; Microsoft Graph Files gains new commands

ThreatZone is effectively rewritten at +3,744/-2,333 — 43% of the day’s insertions and 95% of its deletions (#45598).
20 packs move for 8 upstream commits, roughly 8,588 lines added against 2,452 deleted; the snapshot head 92f01ea is same-day.
Microsoft Graph Files gains new commands and its standard-connector pack moves in step, +381 and +372 (#45485).
Fourteen of the 20 packs are addition-only against a single deleted line — AWS GuardDuty (+298), ePO (+243), Forcepoint DLP (+218), Zscaler ZPA (+215) and Cisco SMA (+161) among them.
Modeling-rule housekeeping continues under CRTX-271523: BC107 legacy-id rules are consolidated for force-merge (#45545), and a Slack GR105 duplicate ID is fixed (#45600).

Highlights

ThreatZone integration update replaces most of the pack

At +3,744/-2,333 it is the day's only substantial rewrite; every other pack combined deletes just 119 lines (#45598).
Microsoft Graph Files gains new commands

The integration adds 381 lines and its separate standard-connector pack a near-identical 372, so both move together (#45485).
ApiModules takes the day's second-largest change

+1,526/-24 in the shared API module pack, which no commit subject names.
CortexDataLake moves by 728 lines

The largest first-party Palo Alto pack change of the day at +728/-64, and the second-largest deletion count; no commit subject names it.
BC107 legacy-id modeling rules are consolidated for force-merge

CRTX-271523 continues from the identity.* series of 19 August (#45545), and a companion fix clears a GR105 duplicate ID caused by a modeling-rule version overlap (#45600).

Changes

20 files listed, 15 written up and shaded below.

▸ ▾ AWS-GuardDuty modified +298 −1 Gains 298 lines against a single deletion; no commit subject names the pack. Packs/AWS-GuardDuty

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ApiModules modified +1526 −24 Gains 1,526 lines against 24 deleted, the day's second-largest change; no commit subject names the pack. Packs/ApiModules

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CiscoNexus modified +42 −1 Packs/CiscoNexus

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CiscoSMA modified +161 −1 Gains 161 lines against a single deletion; no commit subject names the pack. Packs/CiscoSMA

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Citrix modified +211 −13 +211/-13 for a fix to the pack (#45594) — the largest deletion count of the day outside ThreatZone and CortexDataLake. Packs/Citrix

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommonScripts modified +2 −1 Packs/CommonScripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Core modified +16 −1 +16/-1, a version bump adding a timeout field to SearchIndicatorInEventsAgentix (#45515). Packs/Core

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CortexDataLake modified +728 −64 +728/-64, the largest first-party Palo Alto pack movement of the day; no commit subject names the pack. Packs/CortexDataLake

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ForcepointDLP modified +218 −1 Gains 218 lines against a single deletion; no commit subject names the pack. Packs/ForcepointDLP

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GitLab modified +75 −1 Packs/GitLab

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ IronscalesEventCollector modified +102 −1 Packs/IronscalesEventCollector

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ManageEngine-ADAudit modified +167 −1 Gains 167 lines against a single deletion; no commit subject names the pack. Packs/ManageEngine-ADAudit

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftGraphFiles modified +381 −2 +381/-2 adding new commands to the integration (#45485). Packs/MicrosoftGraphFiles

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftGraphFilesStandardConnector modified +372 −1 Gains 372 lines against a single deletion, moving in step with the MicrosoftGraphFiles command additions (#45485). Packs/MicrosoftGraphFilesStandardConnector

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ PAN-OS modified +14 −1 +14/-1; no commit subject names the pack. Packs/PAN-OS

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Slack modified +8 −2 +8/-2 resolving a GR105 duplicate ID caused by a modeling-rule version overlap (#45600). Packs/Slack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SonicWallNSv modified +65 −1 Packs/SonicWallNSv

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ThreatZone modified +3744 −2333 +3,744/-2,333 for an integration update (#45598) — 43% of the day's insertions and 95% of its deletions, and the only near-total rewrite. Packs/ThreatZone

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ZscalerZPA modified +215 −1 Gains 215 lines against a single deletion; no commit subject names the pack. Packs/ZscalerZPA

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ epo modified +243 −1 Gains 243 lines against a single deletion; no commit subject names the pack. Packs/epo

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.