Content packs — August 24, 2026

9 files changed, 1606 insertions, 173 deletions — view the commit on the mirror.

Event Collector reliability fixes dominate; USTA deprecated in favour of USTAv4

AWS-GuardDuty takes 70% of the day at +1,123/-110, fixing duplicate events and a fetch stall in its Event Collector (#45492).
USTA is deprecated and USTAv4 updated in the same commit — the day’s only withdrawal (#45624).
Nine packs move for 8 upstream commits, 1,606 lines added against 173 deleted; the snapshot head c9f7d9d is same-day.
Ingestion reliability is the theme: GuardDuty, the Okta Event Collector (#45584) and the Strata Logging Service URL fallback (#45568) are three of the four largest packs.
Modeling-rule housekeeping continues under CRTX-271523 with a CiscoNexus field-separator fix (#45626).

Highlights

USTA is deprecated and USTAv4 updated in its place

One commit moves both packs — USTA +7/-1 and USTAv4 +60/-31 — and it is also the snapshot head for the day (CIAC-17755, #45624).
AWS GuardDuty Event Collector stops duplicating events and stalling

At +1,123/-110 it is both the largest change and the largest deletion count of the day, against 63 deleted lines everywhere else combined (XSUP-73410, #45492).
Strata Logging Service falls back to the migrated SLS URL

The CortexDataLake pack gains 240 lines against a single deletion so the integration can recover when the oproxy URL is unreachable (#45568).
Okta Event Collector event fetching is made more reliable

+85/-7, the third of the day's three collector-reliability fixes (XSUP-73675, #45584).
Unit 42 Threat Intelligence authentication is fixed under UCP mode

+36/-2 clearing an auth error that occurred specifically with UCP authentication mode selected (XSUP-75305, #45604).

Changes

9 files listed, 9 written up and shaded below.

▸ ▾ AWS-GuardDuty modified +1123 −110 +1,123/-110 fixing duplicate events and a fetch stall in the Event Collector (XSUP-73410, #45492) — 70% of the day's insertions and 64% of its deletions. Packs/AWS-GuardDuty

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ AWS-SecurityHub modified +8 −2 +8/-2 correcting the provider name in AWS Security Hub v2 (#45616). Packs/AWS-SecurityHub

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CiscoNexus modified +7 −2 +7/-2 fixing the modeling rule field separator (CRTX-271523, #45626). Packs/CiscoNexus

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Core modified +40 −17 +40/-17; the day's one commit subject that names no pack is an error-classification change (CRTX-255682, #45540). Packs/Core

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CortexDataLake modified +240 −1 +240/-1 adding a fallback to the migrated Strata Logging Service URL when the oproxy URL is unreachable (#45568). Packs/CortexDataLake

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Okta modified +85 −7 +85/-7 improving event-fetching reliability in the Okta Event Collector (XSUP-73675, #45584). Packs/Okta

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ USTA modified +7 −1 +7/-1 marking the pack deprecated in favour of USTAv4 (CIAC-17755, #45624). Packs/USTA

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ USTAv4 modified +60 −31 +60/-31, updated in the same commit that deprecates the original USTA pack (CIAC-17755, #45624). Packs/USTAv4

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Unit42ThreatIntelligencebyPaloAltoNetworks modified +36 −2 +36/-2 fixing an authentication error under UCP authentication mode (XSUP-75305, #45604). Packs/Unit42ThreatIntelligencebyPaloAltoNetworks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.