Content packs — September 01, 2026

30 files changed, 6177 insertions, 96 deletions — view the commit on the mirror.

An identity.* modeling-rule sweep touches 26 packs; Flashpoint 2.2.4 is the day's one real release

Six of the day’s ten upstream commits are the same sweep — CRTX-271525 and CRTX-271527, “add identity.* to modeling rules”, PRs 2 through 6 of 7.
26 of the 30 packs that moved added lines against exactly one deletion each, the shape of that sweep: new modeling-rule content plus a version bump.
Flashpoint 2.2.4 is the exception and the largest change, +1,629/-60.
Three genuine fixes landed: MailListener - POP3 date parsing, XSOARmirroring re-enabling get-modified-remote-data, and a reset/refresh-token ordering fix.
30 packs in total, 6,177 lines added against 96 removed.

Highlights

identity.* is being added to modeling rules across the catalog, five PRs at a time

PRs 2 through 6 of a series of 7 landed on one day under CRTX-271525 and CRTX-271527, which accounts for 26 of the 30 packs and all but one of the day's large additions.
Flashpoint Release 2.2.4

The day's biggest pack change at +1,629/-60, and the only one removing more than four lines, so the only pack whose existing content was reworked rather than extended.
MailListener POP3 no longer fails to fetch on a date format

XSUP-75797, a support-raised fetch error, fixed in 89 lines against 3 removed.
XSOAR mirroring re-enables get-modified-remote-data

A command that had been turned off is switched back on (+41/-4), which changes how mirrored incidents refresh.
A reset command now runs before the refresh token is fetched

The day's one unclaimed subject, and MicrosoftManagementActivity is the only remaining pack with more than one deletion (+45/-3).

Changes

30 files listed, 15 written up and shaded below.

▸ ▾ AzureKubernetesServices modified +517 −1 Largest pack of the identity.* modeling-rule sweep at +517/-1. Packs/AzureKubernetesServices

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ BeyondTrust_Password_Safe modified +180 −1 identity.* modeling-rule additions, +180/-1. Packs/BeyondTrust_Password_Safe

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CiscoAppDynamics modified +70 −1 Packs/CiscoAppDynamics

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CiscoSpark modified +98 −1 Packs/CiscoSpark

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Cisco_Wireless_LAN_Controller modified +471 −1 identity.* modeling-rule additions, +471/-1. Packs/Cisco_Wireless_LAN_Controller

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CohesityHelios modified +143 −1 Packs/CohesityHelios

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ CyberArk_Privileged_Threat_Analytics modified +109 −1 Packs/CyberArk_Privileged_Threat_Analytics

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FireEyeETP modified +128 −1 Packs/FireEyeETP

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Flashpoint modified +1629 −60 Release 2.2.4, the day's largest change and the only substantial rework (+1,629/-60). Packs/Flashpoint

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ FortiManager modified +81 −1 Packs/FortiManager

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Fortimail modified +231 −1 identity.* modeling-rule additions, +231/-1. Packs/Fortimail

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ GoogleCloudSCC modified +102 −1 Packs/GoogleCloudSCC

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ IBMGuardium modified +256 −1 identity.* modeling-rule additions, +256/-1. Packs/IBMGuardium

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Incapsula modified +228 −1 identity.* modeling-rule additions, +228/-1. Packs/Incapsula

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ IvantiPulseSecureVTM modified +157 −1 identity.* modeling-rule additions, +157/-1. Packs/IvantiPulseSecureVTM

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MailListener_-_POP3 modified +89 −3 Fixes the XSUP-75797 POP3 fetch error caused by a date format (+89/-3). Packs/MailListener_-_POP3

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftCloudAppSecurity modified +160 −1 identity.* modeling-rule additions, +160/-1. Packs/MicrosoftCloudAppSecurity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ MicrosoftManagementActivity modified +45 −3 Reorders the reset command to run before the refresh token is obtained (+45/-3). Packs/MicrosoftManagementActivity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ OktaAuth0 modified +135 −1 Packs/OktaAuth0

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ ProofpointEmailSecurity modified +165 −1 identity.* modeling-rule additions, +165/-1. Packs/ProofpointEmailSecurity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SafeNet_Trusted_Access modified +73 −1 Packs/SafeNet_Trusted_Access

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SecureAuthIdentityPlatform modified +146 −1 Packs/SecureAuthIdentityPlatform

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SentinelOne modified +279 −1 identity.* modeling-rule additions, +279/-1. Packs/SentinelOne

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Squid modified +50 −1 Packs/Squid

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ SymantecEndpointSecurity modified +133 −1 Packs/SymantecEndpointSecurity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ TeamViewer modified +91 −1 Packs/TeamViewer

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ Trellix_ePO modified +101 −1 Packs/Trellix_ePO

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ TrendMicroEmailSecurity modified +176 −1 identity.* modeling-rule additions, +176/-1. Packs/TrendMicroEmailSecurity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ XSOARmirroring modified +41 −4 Re-enables the get-modified-remote-data command (+41/-4). Packs/XSOARmirroring

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
▸ ▾ iManageThreatManager modified +93 −1 Packs/iManageThreatManager

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.