Content packs — August 27, 2026
222 files changed, 10921 insertions, 6078 deletions — view the commit on the mirror.
A 222-pack metadata sweep: supportedModules lands on existing fetch-incidents params
- 222 packs move for 7 upstream commits (+10,921/-6,078). No pack was added or removed.
- Two of those commits are phases 1 and 2 of one
supportedModulessweep over existing Fetch Incidents parameters (CIAC-17795) — the only change large enough to explain a pack count this high. - The day is mostly metadata: 196 of the 222 packs delete 3 lines or fewer, and 179 change 30 lines or fewer in total.
- Two thirds of the 16,999 changed lines sit in seven packs whose insertions and deletions nearly cancel — IronPort, Gem, DatadogCloudSIEM, DataBee, Sysdig, DigitalShadows and Orca.
- The remaining five commits are product fixes:
xdr-xql-generic-queryarguments, Intune timestamp parsing, Netskope network-event mapping, and two KeyError fixes.
Highlights
-
xdr-xql-generic-query gains source_id and source_name arguments
CRTX-269392 (#45513); CortexXDR (+37/-25) and Core (+45/-25) both move by near-identical amounts, the signature of the paired XDR and XSIAM copies of one command.
-
supportedModules is updated on existing Fetch Incidents parameters in two phases
CIAC-17795 lands as #45667 and #45670 on the same day; the snapshot does not name the packs each phase touched, but nothing else on the day could move 222 of them.
-
Seven packs are rewritten near line-for-line and gain almost nothing
IronPort (+1,863/-1,850) leads; Gem, DatadogCloudSIEM, DataBee, Sysdig, DigitalShadows and Orca repeat the shape, together 66% of the day's churn for a net of a few dozen lines.
-
Netskope maps xdm.observer.action to action for network events
XSUP-75725 (#45677) changes what the pack writes into the XDM observer field for network events; the pack moves +40/-5.
-
The Intune parsing rule stops requiring fractional seconds in timestamps
XSUP-74549 (#45654); MicrosoftIntune moves +10/-3, consistent with a single parsing-rule edit.
-
Two KeyError fixes: Jira Service Management and HealthCheckCommonIndicators
XSUP-75105 (#45582) and #45354 (#45676) land together; HealthCheck is the day's largest addition outside the rewritten packs at +149/-5.
Changes
222 files listed, 14 written up and shaded below.
-
▸ ▾ VaronisDataSecurityPlatform modified +28 −1
Packs/VaronisDataSecurityPlatformRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ VaronisSaaS modified +17 −4
Packs/VaronisSaaSRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ VectraRUX modified +27 −2
Packs/VectraRUXRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ VectraXDR modified +14 −1
Packs/VectraXDRRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Vectra_AI modified +16 −3
Packs/Vectra_AIRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Verodin modified +24 −1
Packs/VerodinRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ VirusTotal modified +39 −2
Packs/VirusTotalRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ WootCloud modified +25 −1
Packs/WootCloudRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Workday modified +44 −1
Packs/WorkdayRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ XMCO modified +15 −1
Packs/XMCORead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ XMCyber modified +28 −1
Packs/XMCyberRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ XMatters modified +32 −1
Packs/XMattersRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ XSOARmirroring modified +14 −1
Packs/XSOARmirroringRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Zendesk modified +19 −1
Packs/ZendeskRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ZeroFox modified +70 −56
Packs/ZeroFoxRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ZeroTrustAnalyticsPlatform modified +33 −1
Packs/ZeroTrustAnalyticsPlatformRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Zimperium modified +25 −1
Packs/ZimperiumRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ctf01 modified +20 −1
Packs/ctf01Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ knowbe4Phisher modified +14 −1
Packs/knowbe4PhisherRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ mcafeeDam modified +24 −1
Packs/mcafeeDamRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ mnemonicMDR modified +14 −1
Packs/mnemonicMDRRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ sampleSiem modified +18 −1
Packs/sampleSiemRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.