Content packs — September 03, 2026
8 files changed, 18393 insertions, 3154 deletions — view the commit on the mirror.
Veeam App v2.0.0 lands; GitHub Feed CIDR truncation and XDR Collector _time parsing fixed
- Veeam shipped a v2.0.0 app, 15,708 insertions against 2,302 deletions — larger than the other seven packs of the day combined.
- Two ingestion-correctness fixes worth acting on: FeedGitHub was truncating CIDR prefix lengths, and LinuxEventsCollection was setting
_timewrongly for XDR Collector logs. - CyberArkEPM moved to a version-less EPM API and fixed set names containing commas.
- The rest is fetch reliability and parsing repair in CybleEventsV2, MailListener and HealthCheck.
Highlights
-
Veeam App v2.0.0
A major-version release and by far the day's largest change at 15,708 insertions and 2,302 deletions.
-
GitHub Feed was truncating CIDR prefix lengths
A feed emitting truncated CIDRs produces indicators covering the wrong address range, so any ranges ingested before this fix are suspect.
-
XDR Collector logs had the wrong _time, with a collection-time fallback added
Event timestamps for Linux collection are corrected and now fall back to collection time when the log's own timestamp cannot be parsed.
-
CyberArk EPM switched to the version-less EPM API
The integration no longer pins an EPM API version, and set names containing commas are parsed correctly.
Changes
8 files listed, 8 written up and shaded below.
-
▸ ▾ CyberArkEPM modified +1149 −120 Uses the version-less EPM API and fixes handling of set names that contain commas (XSUP-74944).
Packs/CyberArkEPMRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ CybleEventsV2 modified +652 −151 Fetch reliability and incident submission reworked, 652 insertions against 151 deletions.
Packs/CybleEventsV2Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ DuoAdminApi modified +22 −19 A small pydantic bug fix, 22 insertions against 19 deletions.
Packs/DuoAdminApiRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ FeedGitHub modified +92 −4 Fixes truncated CIDR prefix lengths in the emitted feed indicators.
Packs/FeedGitHubRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ HealthCheck modified +646 −543 Updated for both v6 and v8, rewriting roughly as much as it adds (646 insertions, 543 deletions).
Packs/HealthCheckRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ LinuxEventsCollection modified +15 −2 Fixes _time for XDR Collector logs and adds a collection-time fallback (XSUP-74923).
Packs/LinuxEventsCollectionRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ MailListener modified +109 −13 Fixes a date parsing issue in Mail Listener v2 (XSUP-76251).
Packs/MailListenerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
-
▸ ▾ Veeam modified +15708 −2302 Veeam App v2.0.0, a major-version release of 15,708 insertions and 2,302 deletions.
Packs/VeeamRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.