From c99c74f508c2cc2e21d103f2ccb49d7599b63e6a Mon Sep 17 00:00:00 2001
From: Sergei Yakima <syakima@paloaltonetworks.com>
Date: Thu, 22 Oct 2026 17:42:54 +0300
Subject: [PATCH 1/7] exclude severity & subtype 'all' value from constraint as
 it does no affect query construction

---
 .../Integrations/CortexDataLake/CortexDataLake.py        | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
index 6f5c7c159c20..7e0bab067f90 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
@@ -1320,17 +1320,20 @@ def prepare_fetch_incidents_query(
     Returns:
         SQL query that matches the arguments
     """
-    if fetch_filter and (fetch_subtype or fetch_severity):
+    # "all" adds no condition to the query, so it does not conflict with a fetch filter.
+    has_subtype_restriction = bool(fetch_subtype) and "all" not in fetch_subtype
+    has_severity_restriction = bool(fetch_severity) and "all" not in fetch_severity
+    if fetch_filter and (has_subtype_restriction or has_severity_restriction):
         raise DemistoException("Fetch Filter parameter cannot be used with Subtype/Severity parameters.")
     query = f"SELECT {fetch_fields} FROM `{fetch_table}` "  # guardrails-disable-line # noqa: S608
     time_filter = "event_time" if "log" in fetch_table else "time_generated"
     query += f'WHERE {time_filter} Between TIMESTAMP("{fetch_timestamp}") AND CURRENT_TIMESTAMP'
     if fetch_filter:
         query += f" AND {fetch_filter}"
-    if fetch_subtype and "all" not in fetch_subtype:
+    if has_subtype_restriction:
         sub_types = [f'sub_type.value = "{sub_type}"' for sub_type in fetch_subtype]
         query += f' AND ({" OR ".join(sub_types)})'
-    if fetch_severity and "all" not in fetch_severity:
+    if has_severity_restriction:
         severities = [f'vendor_severity.value = "{severity}"' for severity in fetch_severity]
         query += f' AND ({" OR ".join(severities)})'
     query += f" ORDER BY {time_filter} ASC LIMIT {fetch_limit}"

From 1a857cd8b5bcd41cbe73b78dd6996838fd0a076b Mon Sep 17 00:00:00 2001
From: Sergei Yakima <syakima@paloaltonetworks.com>
Date: Thu, 22 Oct 2026 17:43:41 +0300
Subject: [PATCH 2/7] update documentation

---
 .../Integrations/CortexDataLake/CortexDataLake.yml              | 2 +-
 .../Integrations/CortexDataLake/CortexDataLake_description.md   | 2 ++
 Packs/CortexDataLake/Integrations/CortexDataLake/README.md      | 2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
index d7f75c2935b5..6de7037e99f2 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
@@ -142,7 +142,7 @@ configuration:
   type: 12
   required: false
   section: Collect
-- additionalinfo: 'Filter the fetched incidents according to the given query. Query example: "source_ip.value LIKE `192.168.1.*` AND dst = `192.168.1.12`" Note: Can not be used in combination with `Severity` and `Subtype` parameters.'
+- additionalinfo: 'Filter the fetched incidents according to the given query. Query example: "source_ip.value LIKE `192.168.1.*` AND dst = `192.168.1.12`" Note: Can not be used in combination with specific `Severity` and `Subtype` values. Leave them empty or set to "all".'
   display: Fetch Filter
   name: filter_query
   type: 12
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md
index 1061f0205aa2..2c8ce8608d04 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md
@@ -30,6 +30,8 @@ This integration was tested with version 2 of Strata Logging Service XSOAR Conne
     * **insecure**: Trust any certificate (not secure).
     * **Fetch incidents**: Whether to fetch incidents.
     * **First fetch time**: First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year).
+    * **Fetch Table**: The table incidents are fetched from.
+    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity** or **Subtype** values. When using a Fetch Filter, leave those parameters empty or set to "all".
     * **Severity of events to fetch (Firewall)**: Select from all, Critical, High, Medium, Low, Informational, or Unused.
     * **Subtype of events to fetch (Firewall)**: Select from all, attack, url, virus, spyware, vulnerability, file, scan, flood, packet, resource, data, url-content, wildfire, extpcap, wildfire-virus, http-hdr-insert, http-hdr, email-hdr, spyware-dns, spyware-wildfire-dns, spyware-wpc-dns, spyware-custom-dns, spyware-cloud-dns, spyware-raven, spyware-wildfire-raven, spyware-wpc-raven, wpc-virus, or sctp.
 7. Click **Test** to validate the credentials and connection.
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/README.md b/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
index 1efe7867cb7a..bfe39926df3a 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
@@ -30,6 +30,8 @@ This integration was tested with version 2 of Strata Logging Service XSOAR Conne
     * **insecure**: Trust any certificate (not secure).
     * **Fetch incidents**: Whether to fetch incidents.
     * **First fetch time**: First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year).
+    * **Fetch Table**: The table incidents are fetched from.
+    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity** or **Subtype** values. When using a Fetch Filter, leave those parameters empty or set to "all".
     * **Severity of events to fetch (Firewall)**: Select from all, Critical, High, Medium, Low, Informational, or Unused.
     * **Subtype of events to fetch (Firewall)**: Select from all, attack, url, virus, spyware, vulnerability, file, scan, flood, packet, resource, data, url-content, wildfire, extpcap, wildfire-virus, http-hdr-insert, http-hdr, email-hdr, spyware-dns, spyware-wildfire-dns, spyware-wpc-dns, spyware-custom-dns, spyware-cloud-dns, spyware-raven, spyware-wildfire-raven, spyware-wpc-raven, wpc-virus, or sctp.
 7. Click **Test** to validate the credentials and connection.

From 7a8d27b8c2b43d106b2402d778977bdf87a73196 Mon Sep 17 00:00:00 2001
From: Sergei Yakima <syakima@paloaltonetworks.com>
Date: Thu, 22 Oct 2026 17:50:37 +0300
Subject: [PATCH 3/7] add release notes

---
 Packs/CortexDataLake/ReleaseNotes/1_6_4.md | 7 +++++++
 Packs/CortexDataLake/pack_metadata.json    | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 Packs/CortexDataLake/ReleaseNotes/1_6_4.md

diff --git a/Packs/CortexDataLake/ReleaseNotes/1_6_4.md b/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
new file mode 100644
index 000000000000..86ac865adc60
--- /dev/null
+++ b/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### Strata Logging Service XSOAR Connector
+
+- Fixed an issue where fetching incidents failed when the **Fetch Filter** parameter was used together with the **Severity** or **Subtype** parameters set to "all".
+- Documentation and metadata improvements.
diff --git a/Packs/CortexDataLake/pack_metadata.json b/Packs/CortexDataLake/pack_metadata.json
index bd35aa477235..36dcbec67ebe 100644
--- a/Packs/CortexDataLake/pack_metadata.json
+++ b/Packs/CortexDataLake/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Strata Logging Service by Palo Alto Networks",
     "description": "Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your on-premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR",
     "support": "xsoar",
-    "currentVersion": "1.6.3",
+    "currentVersion": "1.6.4",
     "author": "Cortex XSOAR",
     "url": "https://docs.paloaltonetworks.com/strata-logging-service",
     "email": "",

From 1bd8d05fbed0d93f9a31d8b7aea3038bb5c6d77f Mon Sep 17 00:00:00 2001
From: Sergei Yakima <syakima@paloaltonetworks.com>
Date: Thu, 22 Oct 2026 22:09:35 +0300
Subject: [PATCH 4/7] format release notes

---
 Packs/CortexDataLake/ReleaseNotes/1_6_4.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Packs/CortexDataLake/ReleaseNotes/1_6_4.md b/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
index 86ac865adc60..d826350e120c 100644
--- a/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
+++ b/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
@@ -3,5 +3,5 @@
 
 ##### Strata Logging Service XSOAR Connector
 
-- Fixed an issue where fetching incidents failed when the **Fetch Filter** parameter was used together with the **Severity** or **Subtype** parameters set to "all".
+- Fixed an issue where fetching incidents failed when the *Fetch Filter* parameter was used together with the *Severity of events to fetch (Firewall)* or *Subtype of events to fetch (Firewall)* parameters set to "all".
 - Documentation and metadata improvements.

From 5db32b1526ab66003224b8818f9c7f13ee721170 Mon Sep 17 00:00:00 2001
From: Sergei Yakima <syakima@paloaltonetworks.com>
Date: Thu, 22 Oct 2026 22:14:32 +0300
Subject: [PATCH 5/7] improve wording

---
 .../Integrations/CortexDataLake/CortexDataLake_description.md   | 2 +-
 Packs/CortexDataLake/Integrations/CortexDataLake/README.md      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md
index 2c8ce8608d04..e98db442d788 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md
@@ -31,7 +31,7 @@ This integration was tested with version 2 of Strata Logging Service XSOAR Conne
     * **Fetch incidents**: Whether to fetch incidents.
     * **First fetch time**: First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year).
     * **Fetch Table**: The table incidents are fetched from.
-    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity** or **Subtype** values. When using a Fetch Filter, leave those parameters empty or set to "all".
+    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity of events to fetch (Firewall)** or **Subtype of events to fetch (Firewall)** values. When using a Fetch Filter, leave those parameters empty or set them to "all".
     * **Severity of events to fetch (Firewall)**: Select from all, Critical, High, Medium, Low, Informational, or Unused.
     * **Subtype of events to fetch (Firewall)**: Select from all, attack, url, virus, spyware, vulnerability, file, scan, flood, packet, resource, data, url-content, wildfire, extpcap, wildfire-virus, http-hdr-insert, http-hdr, email-hdr, spyware-dns, spyware-wildfire-dns, spyware-wpc-dns, spyware-custom-dns, spyware-cloud-dns, spyware-raven, spyware-wildfire-raven, spyware-wpc-raven, wpc-virus, or sctp.
 7. Click **Test** to validate the credentials and connection.
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/README.md b/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
index bfe39926df3a..b73bbffa5313 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
@@ -31,7 +31,7 @@ This integration was tested with version 2 of Strata Logging Service XSOAR Conne
     * **Fetch incidents**: Whether to fetch incidents.
     * **First fetch time**: First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year).
     * **Fetch Table**: The table incidents are fetched from.
-    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity** or **Subtype** values. When using a Fetch Filter, leave those parameters empty or set to "all".
+    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity of events to fetch (Firewall)** or **Subtype of events to fetch (Firewall)** values. When using a Fetch Filter, leave those parameters empty or set them to "all".
     * **Severity of events to fetch (Firewall)**: Select from all, Critical, High, Medium, Low, Informational, or Unused.
     * **Subtype of events to fetch (Firewall)**: Select from all, attack, url, virus, spyware, vulnerability, file, scan, flood, packet, resource, data, url-content, wildfire, extpcap, wildfire-virus, http-hdr-insert, http-hdr, email-hdr, spyware-dns, spyware-wildfire-dns, spyware-wpc-dns, spyware-custom-dns, spyware-cloud-dns, spyware-raven, spyware-wildfire-raven, spyware-wpc-raven, wpc-virus, or sctp.
 7. Click **Test** to validate the credentials and connection.

From e39b6d38cff663b7f2ebfc90f3b18bdc146f57cf Mon Sep 17 00:00:00 2001
From: Sergei Yakima <syakima@paloaltonetworks.com>
Date: Sun, 25 Oct 2026 11:13:39 +0200
Subject: [PATCH 6/7] address docs review suggestions

---
 Packs/CortexDataLake/ReleaseNotes/1_6_4.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Packs/CortexDataLake/ReleaseNotes/1_6_4.md b/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
index d826350e120c..0ac031e1366d 100644
--- a/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
+++ b/Packs/CortexDataLake/ReleaseNotes/1_6_4.md
@@ -3,5 +3,5 @@
 
 ##### Strata Logging Service XSOAR Connector
 
-- Fixed an issue where fetching incidents failed when the *Fetch Filter* parameter was used together with the *Severity of events to fetch (Firewall)* or *Subtype of events to fetch (Firewall)* parameters set to "all".
-- Documentation and metadata improvements.
+- Fixed an issue where fetching incidents failed when the *Fetch Filter* parameter was used together with the *Severity of events to fetch (Firewall)* or *Subtype of events to fetch (Firewall)* parameters set to **all**.
+- Updated the integration documentation and the *Fetch Filter* parameter help text to clarify that *Fetch Filter* cannot be used with specific *Severity of events to fetch (Firewall)* or *Subtype of events to fetch (Firewall)* values.

From 8a5ce7b5280239b3062cf4633727884ba13f4c24 Mon Sep 17 00:00:00 2001
From: Sergei Yakima <syakima@paloaltonetworks.com>
Date: Sun, 25 Oct 2026 14:32:49 +0200
Subject: [PATCH 7/7] bump version

---
 Packs/CortexDataLake/ReleaseNotes/{1_6_4.md => 1_6_5.md} | 0
 Packs/CortexDataLake/pack_metadata.json                  | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename Packs/CortexDataLake/ReleaseNotes/{1_6_4.md => 1_6_5.md} (100%)

diff --git a/Packs/CortexDataLake/ReleaseNotes/1_6_4.md b/Packs/CortexDataLake/ReleaseNotes/1_6_5.md
similarity index 100%
rename from Packs/CortexDataLake/ReleaseNotes/1_6_4.md
rename to Packs/CortexDataLake/ReleaseNotes/1_6_5.md
diff --git a/Packs/CortexDataLake/pack_metadata.json b/Packs/CortexDataLake/pack_metadata.json
index 36dcbec67ebe..221430c15cc4 100644
--- a/Packs/CortexDataLake/pack_metadata.json
+++ b/Packs/CortexDataLake/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Strata Logging Service by Palo Alto Networks",
     "description": "Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your on-premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR",
     "support": "xsoar",
-    "currentVersion": "1.6.4",
+    "currentVersion": "1.6.5",
     "author": "Cortex XSOAR",
     "url": "https://docs.paloaltonetworks.com/strata-logging-service",
     "email": "",