Content packs — August 26, 2026

11 files changed, 2128 insertions, 239 deletions — view the commit on the mirror.

A narrow 11-pack day: QRadar rewritten, Microsoft Entra ID nearly doubles in additions

Only 11 packs move for 5 upstream commits — +2,128/-239 — a quarter of the previous day’s pack count.
QRadar (+1,080/-184) and MicrosoftEntraID (+774/-1) are 87% of the day’s insertions between them; everything else is small.
QRadar carries nearly all the day’s deletions, so that pack was rewritten rather than extended; Entra ID is near-pure addition.
Two Slack commits land together: telemetry-failure list messages and an auth_target mapping for event 102.
The identity.* modeling-rule work continues at PR 2 of 7 (CRTX-271527, #45464), a day after PR 1.

Highlights

QRadar is the day's dominant change at +1,080/-184

The pack holds 76% of the day's deletions against 51% of its insertions, so existing code was replaced; the commit subject is only "Qradar" (#45622) and says no more.
Microsoft Entra ID gains 774 lines against a single deletion

The day's largest near-pure addition, and the snapshot names no commit subject for it.
identity.* fields reach modeling rules PR 2 of 7

CRTX-271527 (#45464) continues the seven-part ingestion-mapping series that opened the day before; the snapshot does not say which pack carried it.
Slack moves twice — telemetry failure messages and an event 102 auth_target mapping

CRTX-275112 (#45629) and CRTX-274913 (#45648) together account for the pack's +40/-15.
Four unrelated packs move by an identical +9/-2

Active Directory Query, Core, Filters And Transformers and Smokescreen IllusionBLACK change by the same amount, the signature of one shared edit applied across packs.
A script migration is the day's snapshot head

CRTX-265664 (#45511) is the newest commit in the day's window; CommonScripts (+69/-11) and Base (+14/-3) are the largest of the remaining pack moves.

Changes

11 files listed, 11 written up and shaded below.

▸ ▾ Active_Directory_Query modified +9 −2 +9/-2, one of four packs moving by an identical amount. Packs/Active_Directory_Query

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Base modified +14 −3 +14/-3, unattributed in the day's commit subjects. Packs/Base

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CloudIncidentResponse modified +59 −16 +59/-16, the third-highest deletion count of the day and unattributed in the commit subjects. Packs/CloudIncidentResponse

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CommonScripts modified +69 −11 +69/-11, unattributed by subject on a day whose head commit is a script migration (#45511). Packs/CommonScripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Core modified +9 −2 +9/-2, one of four packs moving by an identical amount. Packs/Core

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FiltersAndTransformers modified +9 −2 +9/-2, one of four packs moving by an identical amount. Packs/FiltersAndTransformers

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftEntraID modified +774 −1 +774/-1, the day's largest near-pure addition; unattributed in the day's commit subjects. Packs/MicrosoftEntraID

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ QRadar modified +1080 −184 +1,080/-184, the day's largest pack change and the source of most of its deletions (#45622). Packs/QRadar

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Slack modified +40 −15 +40/-15 across two commits: telemetry failure list messages (CRTX-275112, #45629) and an auth_target mapping for event 102 (CRTX-274913, #45648). Packs/Slack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Smokescreen_IllusionBLACK modified +9 −2 +9/-2, one of four packs moving by an identical amount. Packs/Smokescreen_IllusionBLACK

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Tableau modified +56 −1 +56/-1, near-pure addition with no commit subject naming it. Packs/Tableau

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.