> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-08-28.md).

# 2024.08.28

**Release date: 11-September-2024**

| Change type                                                    | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added 4 new Low Analytics BIOCs                                | <ul><li><a href="/analytics-alerts/alerts-by-name/new-ftp-server.md">New FTP Server</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-ssh-downgrade.md">Suspicious SSH Downgrade</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-crypto-wallet-s-files.md">Unusual process accessed a crypto wallet's files</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-messaging-app-s-files.md">Unusual process accessed a messaging app's files</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Added a new Informational Analytics BIOC                       | <ul><li><a href="/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace.md">Kubernetes Pod Created with host Inter Process Communications (IPC) namespace</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Added a new Informational Analytics Alert                      | <ul><li><a href="/analytics-alerts/alerts-by-name/rare-access-to-known-advertising-domains.md">Rare access to known advertising domains</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of a Medium Analytics BIOC                      | <ul><li><a href="/analytics-alerts/alerts-by-name/executable-created-to-disk-by-lsass-exe.md">Executable created to disk by lsass.exe</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Improved logic of a Medium Analytics Alert                     | <ul><li><a href="/analytics-alerts/alerts-by-name/dns-tunneling.md">DNS Tunneling</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Improved logic of 2 Low Analytics BIOCs                        | <ul><li><a href="/analytics-alerts/alerts-by-name/a-rare-ftp-user-has-been-detected-on-an-existing-ftp-server.md">A rare FTP user has been detected on an existing FTP server</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md">Unusual process accessed FTP Client credentials</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of 3 Low Analytics Alerts                       | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-icmp-echo-ping-to-multiple-hosts.md">Abnormal ICMP echo (PING) to multiple hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts.md">Abnormal sensitive RPC traffic to multiple hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/spam-bot-traffic.md">Spam Bot Traffic</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Improved logic of 17 Informational Analytics BIOCs             | <ul><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md">A cloud identity executed an API call from an unusual country</a></li><li><a href="/analytics-alerts/alerts-by-name/a-compute-attached-identity-executed-api-calls-outside-the-instance-s-region.md">A compute-attached identity executed API calls outside the instance's region</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-communication-to-a-rare-domain.md">Abnormal Communication to a Rare Domain</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-recurring-communications-to-a-rare-domain.md">Abnormal Recurring Communications to a Rare Domain</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-file-added-to-startup-related-registry-keys.md">An uncommon file added to startup-related Registry keys</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage.md">Execution of an uncommon process at an early startup stage</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage.md">Execution of an uncommon process with a local/domain user SID at an early startup stage</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume.md">Kubernetes Pod Created With Sensitive Volume</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md">Kubernetes Pod created with host process ID (PID) namespace</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md">Kubernetes Privileged Pod Creation</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md">Kubernetes pod creation with host network</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md">Rare process accessed a Keychain file</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Uncommon net group or localgroup execution</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md">Unusual Kubernetes service account file read</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md">Unusual process accessed a macOS notes DB file</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md">Unusual process accessed web browser cookies</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md">Unusual process accessed web browser credentials</a></li></ul> |
| Improved logic of an Informational Analytics Alert             | <ul><li><a href="/analytics-alerts/alerts-by-name/port-scan.md">Port Scan</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Decreased the severity to Informational for an Analytics BIOC  | <ul><li><a href="/analytics-alerts/alerts-by-name/cloud-email-service-activity.md">Cloud email service activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Decreased the severity to Informational for an Analytics Alert | <ul><li><a href="/analytics-alerts/alerts-by-name/possible-tgt-reuse-from-different-hosts-pass-the-ticket.md">Possible TGT reuse from different hosts (pass the ticket)</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-08-28.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.