Content packs — September 02, 2026
37 files changed, 6365 insertions, 1599 deletions — view the commit on the mirror.
Microsoft Teams moves to a new standard-connector pack; the identity.* modeling-rule sweep finishes
- MicrosoftGraphTeams loses 732 lines against 12 added while a new MicrosoftGraphTeamsStandardConnector pack appears at +287/-0 — the day’s one structural move.
- The
identity.*modeling-rule series ends: PR 7 of 7 lands for both CRTX-271525 and CRTX-271527, alongside PRs 3, 5 and 6. - 25 of the 37 packs added lines against exactly one deletion each, that sweep’s signature shape.
- Five substantive fixes landed — Bitbucket authentication, Microsoft Defender for Cloud Apps watermarking, Elasticsearch Kibana URL, Zscaler 401 handling, and an Enterprise DLP argument.
- 37 packs, 6,365 lines added against 1,599 removed, from 15 upstream commits.
Highlights
-
The Microsoft Teams integration is re-homed into a standard-connector pack
MicrosoftGraphTeams is the only pack losing substantially more than it gains (+12/-732) on the same day a new MicrosoftGraphTeamsStandardConnector pack is added with no deletions at all, so existing Teams content moves rather than changes.
-
Bitbucket gains new authentication methods in a near-total rewrite
At +569/-597 it is the only pack that removed roughly as much as it added, so the existing auth path was replaced rather than extended.
-
Microsoft Defender for Cloud Apps fixes a stalled event-type watermark
XSUP-72224, a support-raised collector bug where the fetch watermark stopped advancing, plus a now-configurable fetch limit (+511/-33).
-
ApiModules is the day's largest single change at +1,418
It carries one deletion, the additive shape of the modeling-rule sweep, but no commit subject names it.
-
The identity.* modeling-rule series reaches PR 7 of 7
Both CRTX-271525 and CRTX-271527 land their final part today after PRs 2 through 6 landed on 1 September, closing a sweep that has touched packs across two days.
-
Phishing reworks a reported-email deletion path
At +333/-169 it is the day's second-largest rework, and the commit list carries a migration of SecurityAndComplianceV2 off the DeleteReportedEmail script to Microsoft Graph Security eDiscovery.
Changes
37 files listed, 15 written up and shaded below.
-
▸ ▾ Absolute modified +133 −1
Packs/AbsoluteRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Akamai_SIEM modified +112 −1
Packs/Akamai_SIEMRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ApiModules modified +1418 −1 The day's largest pack change at +1,418/-1; no commit subject names it.
Packs/ApiModulesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Armis modified +2 −1
Packs/ArmisRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ AzureEventsHub modified +189 −1
Packs/AzureEventsHubRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Bitbucket modified +569 −597 New authentication methods, replacing most of the pack (+569/-597).
Packs/BitbucketRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Celonis modified +83 −1
Packs/CelonisRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Code42 modified +270 −1
Packs/Code42Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CommunityCommonScripts modified +2 −1
Packs/CommunityCommonScriptsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ DeprecatedContent modified +1 −0
Packs/DeprecatedContentRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ DevSecOps modified +2 −1
Packs/DevSecOpsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Doppel modified +1 −0
Packs/DoppelRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Elasticsearch modified +103 −23 Adds a Kibana Server URL parameter, XSUP-76053 (+103/-23).
Packs/ElasticsearchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ F5LTM modified +68 −1
Packs/F5LTMRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ForcepointEmailSecurity modified +209 −1 Additive change in the sweep's shape, +209/-1.
Packs/ForcepointEmailSecurityRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ GoogleChronicleBackstory modified +2 −1
Packs/GoogleChronicleBackstoryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ HashiCorp-Vault modified +87 −1
Packs/HashiCorp-VaultRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ HelloWorld modified +52 −1
Packs/HelloWorldRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ HuaweiFW modified +237 −1 Additive change in the sweep's shape, +237/-1.
Packs/HuaweiFWRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ IvantiConnectSecure modified +163 −1
Packs/IvantiConnectSecureRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Jira modified +73 −1
Packs/JiraRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Kiteworks modified +334 −1 Additive change in the sweep's shape, +334/-1.
Packs/KiteworksRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftCloudAppSecurity modified +511 −33 Fixes the XSUP-72224 stalled event-type watermark and makes the fetch limit configurable (+511/-33).
Packs/MicrosoftCloudAppSecurityRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftGraphTeams modified +12 −732 Loses 732 lines against 12 added as Teams content moves to a standard-connector pack.
Packs/MicrosoftGraphTeamsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftGraphTeamsStandardConnector modified +287 −0 New pack, +287/-0, added as the msgraphteams standard connector.
Packs/MicrosoftGraphTeamsStandardConnectorRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MicrosoftIntune modified +124 −1
Packs/MicrosoftIntuneRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ OSQuery modified +83 −8 Updates the OSQueryBasicQuery script (+83/-8).
Packs/OSQueryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ OpenAI modified +372 −1 Largest of the one-deletion additive packs after ApiModules, +372/-1.
Packs/OpenAIRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Palo_Alto_Networks_Enterprise_DLP modified +105 −9 Adds a service_name argument to pan-dlp-get-report (+105/-9).
Packs/Palo_Alto_Networks_Enterprise_DLPRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Phishing modified +333 −169 Reworked at +333/-169, against a SecurityAndComplianceV2 migration to Microsoft Graph Security eDiscovery.
Packs/PhishingRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ RunZero modified +76 −1
Packs/RunZeroRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Unit42ThreatIntelligencebyPaloAltoNetworks modified +15 −1 Updates the feed's outbound requests documentation (+15/-1).
Packs/Unit42ThreatIntelligencebyPaloAltoNetworksRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ VMWareNSX modified +61 −1
Packs/VMWareNSXRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Whois modified +1 −0
Packs/WhoisRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ ZeroNetworksSegment modified +160 −1
Packs/ZeroNetworksSegmentRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Zscaler modified +64 −3 ZscalerZIdentity now handles an HTTP 401 response (+64/-3).
Packs/ZscalerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ jamf modified +51 −1
Packs/jamfRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.