> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-31.md).

# 2024.07.31

**Release date: 13-August-2024**

| Change type                                         | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added a new Medium Analytics Alert                  | <ul><li><a href="/analytics-alerts/alerts-by-name/possible-kerberoasting-attack.md">Possible Kerberoasting attack</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Added 4 new Informational Analytics BIOCs           | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-communication-to-a-rare-domain.md">Abnormal Communication to a Rare Domain</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-recurring-communications-to-a-rare-domain.md">Abnormal Recurring Communications to a Rare Domain</a></li><li><a href="/analytics-alerts/alerts-by-name/dlp-sensitive-data-exposed-to-external-users.md">DLP sensitive data exposed to external users</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-spn-enumeration.md">Possible SPN enumeration</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Added a new Informational Analytics Alert           | <ul><li><a href="/analytics-alerts/alerts-by-name/internal-login-password-spray.md">Internal Login Password Spray</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Improved logic of 2 Medium Analytics BIOCs          | <ul><li><a href="/analytics-alerts/alerts-by-name/kerberos-traffic-from-non-standard-process.md">Kerberos Traffic from Non-Standard Process</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-code-downloading-from-a-remote-host-by-regsvr32.md">Possible code downloading from a remote host by Regsvr32</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Improved logic of 9 Low Analytics BIOCs             | <ul><li><a href="/analytics-alerts/alerts-by-name/non-browser-access-to-a-pastebin-like-site.md">Non-browser access to a pastebin-like site</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-kerberoasting-without-spns.md">Possible Kerberoasting without SPNs</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-rdp-session-to-a-remote-host.md">Rare RDP session to a remote host</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-smb-session-to-a-remote-host.md">Rare SMB session to a remote host</a></li><li><a href="/analytics-alerts/alerts-by-name/recurring-access-to-rare-ip.md">Recurring access to rare IP</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-managed-identity-token.md">Remote usage of an Azure Managed Identity token</a></li><li><a href="/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host.md">Scripting engine connected to a rare external host</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-smb-connection-from-domain-controller.md">Suspicious SMB connection from domain controller</a></li><li><a href="/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-ticket-requested.md">Weakly-Encrypted Kerberos Ticket Requested</a></li></ul> |
| Improved logic of 7 Low Analytics Alerts            | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-sent-multiple-tgt-requests-to-irregular-service.md">A user sent multiple TGT requests to irregular service</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-smb-activity-to-multiple-hosts.md">Abnormal SMB activity to multiple hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts.md">Abnormal sensitive RPC traffic to multiple hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/failed-dns.md">Failed DNS</a></li><li><a href="/analytics-alerts/alerts-by-name/impossible-traveler-sso.md">Impossible traveler - SSO</a></li><li><a href="/analytics-alerts/alerts-by-name/impossible-traveler-vpn.md">Impossible traveler - VPN</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-weakly-encrypted-kerberos-tickets-received.md">Multiple Weakly-Encrypted Kerberos Tickets Received</a></li></ul>                                                                                                                                                                                                                                                                                                                                               |
| Improved logic of 7 Informational Analytics BIOCs   | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Cloud Unusual Instance Metadata Service (IMDS) access</a></li><li><a href="/analytics-alerts/alerts-by-name/file-transfer-from-unusual-ip-using-known-tools.md">File transfer from unusual IP using known tools</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-ldap-enumeration-tool-usage.md">Possible LDAP Enumeration Tool Usage</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-appid-usage-to-a-rare-destination.md">Rare AppID usage to a rare destination</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-dcom-rpc-activity.md">Rare DCOM RPC activity</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity.md">Rare Scheduled Task RPC activity</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-connection-to-external-ip-address-or-host-by-an-application-using-rmi-iiop-or-ldap-protocol.md">Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol</a></li></ul>                                                                                                                                                                                                                          |
| Improved logic of 4 Informational Analytics Alerts  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-executed-multiple-ldap-enumeration-queries.md">A user executed multiple LDAP enumeration queries</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-received-multiple-weakly-encrypted-service-tickets.md">A user received multiple weakly encrypted service tickets</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-requested-multiple-service-tickets.md">A user requested multiple service tickets</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-tgt-requests-for-users-without-kerberos-pre-authentication.md">Multiple TGT requests for users without Kerberos pre-authentication</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Changed metadata of 2 Low Analytics BIOCs           | <ul><li><a href="/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe.md">Attempt to execute a command on a remote host using PsExec.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md">Unusual process accessed FTP Client credentials</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Changed metadata of 5 Informational Analytics BIOCs | <ul><li><a href="/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md">Rare process accessed a Keychain file</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md">Unusual process accessed a macOS notes DB file</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md">Unusual process accessed web browser cookies</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md">Unusual process accessed web browser credentials</a></li><li><a href="/analytics-alerts/alerts-by-name/vpn-access-with-an-abnormal-operating-system.md">VPN access with an abnormal operating system</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-31.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.