Documentation — August 26, 2026
447 files changed, 2598 insertions, 1395 deletions — view the commit on the mirror.
Container registry scanning regrouped by vendor; Identity Profile version floor drops to XSIAM 3.5
- Registry scanning is now licensed by either the Cloud Posture Security or the Cloud Runtime Security add-on, where before only Cloud Runtime Security qualified.
- Twelve container registry pages moved out of Cloud Posture and Runtime Security data sources into per-vendor folders under Vendor-specific data sources and connectors.
- Identity Profile now names Cortex XSIAM 3.5, Cortex XDR 5.1 or Cortex Cloud Runtime 2.1 instead of a flat XSIAM 3.6 floor, and is explicitly unavailable on XSIAM 2.x and XDR 3.x.
- Ubuntu 26 gains supported-kernel pages on x86_64 and aarch64 at agent 9.1.0, alongside newly certified kernels across AlmaLinux, Rocky, RHEL, Oracle, Amazon Linux and Ubuntu.
- Most of the day’s 448 files are an editorial pass: 182 XSIAM pages and most of the 75 Development Guide pages had descriptions and headings rewritten without changing meaning.
Highlights
-
Container registry scanning is now included with the Cloud Posture Security add-on as well
The License type note gained "the Cloud Posture Security or" before "the Cloud Runtime Security add-on", widening which products cover the feature.
-
The six registry connectors moved to per-vendor folders, breaking their old URLs
Docker Hub, Docker V2, GitLab, Harbor, JFrog and Sonatype Nexus and their manage- subpages left container-registry-scanning/ for vendor-specific-data-sources-and-connectors/<vendor>/.
-
Identity Profile prerequisites were restated across three products
"Cortex XSIAM 3.6 or later" became "Cortex XSIAM 3.5, Cortex XDR 5.1, or Cortex Cloud Runtime 2.1 or later", still requiring agent 9.1 and the ITDR add-on.
-
Ubuntu 26 is now a supported kernel platform
New x86_64 and aarch64 pages list 7.0.0-14-generic onward at a 9.1.0 minimum agent version, taking the Linux Kernel Versions book from 100 to 102 pages.
-
The Development Guide's Alerts page is now Issues
Alert fields, layouts, layout rules and mappers were all restated as issue equivalents; the page keeps its alerts.md path, so only the title and body moved.
-
The Broker VM registry scanner page now links to broken-reference six times
Its links to the six connector pages were replaced with the literal placeholder broken-reference rather than repointed at the new vendor paths.
Bulk change — 447 files. Per-file diffs are not stored for a change this size; view it on the mirror.
Changes
447 files listed, 15 written up and shaded below.
-
▸ ▾ XQL Query best practices modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practicesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Legacy Query Builder modified +1 −1
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builderRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create authentication query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-authentication-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create event log query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-event-log-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create file query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-file-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create image load query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-image-load-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create network connections query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-connections-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create network query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create process query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-process-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create registry query modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-registry-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query across all entities modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/query-across-all-entitiesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage scheduled queries modified +1 −1
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Scheduled Queries reference information modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-informationRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage your macros modified +4 −1
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-macrosRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage your personal query library modified +1 −3
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-libraryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Overview of the Query Center modified +1 −3
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-centerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Edit and run queries in Query Center modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-centerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query Center reference information modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/query-center-reference-informationRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query Builder templates modified +1 −3
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templatesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Considerations for using Query Builder templates modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templatesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create a query from a template modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-templateRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Get started with Query Builder templates modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/get-started-with-query-builder-templatesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Query Builder template examples modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/query-builder-template-examplesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Run a free text query modified +5 −1
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/run-a-free-text-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ XQL macros modified +4 −0
xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/xql-macrosRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Cortex XQL syntax, parameters, and examples modified +3 −1
xsiam/reference-and-developer-docs/cortex-agentix-xql/cortex-xql-syntax-parameters-and-examplesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ About examples modified +1 −1
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/about-examplesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Datasets and presets modified +3 −3
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/datasets-and-presetsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ How to filter for empty values in the results table modified +1 −3
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-tableRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ JSON functions modified +1 −3
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/json-functionsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Supported operators modified +1 −3
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operatorsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Understanding string manipulation in XQL modified +2 −2
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xqlRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ XQL language features modified +2 −2
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-featuresRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ XQL Language Structure modified +1 −1
xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structureRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Graph Search modified +1 −1
xsiam/reference-and-developer-docs/graph-searchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create detection rules based on graph search modified +4 −0
xsiam/reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-searchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Create Graph Search query modified +3 −1
xsiam/reference-and-developer-docs/graph-search/create-graph-search-queryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Edit and run queries in Query Center modified +1 −3
xsiam/reference-and-developer-docs/graph-search/edit-and-run-queries-in-query-centerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ FAQ on Graph Search modified +1 −1
xsiam/reference-and-developer-docs/graph-search/faq-on-graph-searchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Get started with Graph Search queries modified +1 −1
xsiam/reference-and-developer-docs/graph-search/get-started-with-graph-search-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Graph Search examples modified +1 −1
xsiam/reference-and-developer-docs/graph-search/graph-search-examplesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ How to build Graph Search queries? modified +1 −3
xsiam/reference-and-developer-docs/graph-search/how-to-build-graph-search-queriesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Manage the Graph Search Query Library modified +1 −3
xsiam/reference-and-developer-docs/graph-search/manage-the-graph-search-query-libraryRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Supported assets and findings modified +4 −0
xsiam/reference-and-developer-docs/graph-search/supported-assets-and-findingsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Understand Graph Search query results modified +1 −1
xsiam/reference-and-developer-docs/graph-search/understand-graph-search-query-resultsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ What is Graph Search? modified +1 −3
xsiam/reference-and-developer-docs/graph-search/what-is-graph-searchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Detection Rules permissions modified +7 −7
xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions/detection-rules-permissionsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.