diff --git a/integrations/rapid7-insightidr/manifest.yaml b/integrations/rapid7-insightidr/manifest.yaml
index 0c841d0..653c831 100644
--- a/integrations/rapid7-insightidr/manifest.yaml
+++ b/integrations/rapid7-insightidr/manifest.yaml
@@ -1,8 +1,8 @@
 id: rapid7_insightidr
 name: Rapid7 InsightIDR
-version: 1.1.0
+version: 1.1.1
 description: "Rapid7 InsightIDR (REST API) — investigation ingestion and full lifecycle (list/get/search/create/update/assign/set-status/bulk-close), investigation alerts and Rapid7 product alerts, custom threat indicators (add/replace), log management and LEQL log/log-set queries with downloads, and user directory search."
-changelog: "1.1.0 — Add the Alert Triage API (/idr/at): search alerts, get an alert, its evidence, its actors and its process trees, plus the tenant's alert field catalogue. These carry the detection content the investigation endpoints do not — MITRE T-codes, matched rule keys, assets and accounts, command lines. MDR-gated. | 1.0.0 — Initial release: investigation ingestion (list_investigations) with an exhaustive OCSF mapper, 18 commands across investigations, alerts, custom threats, logs/LEQL search and users. API v1/v2 selectable per instance and per command."
+changelog: "1.1.1 — list_alert_fields: default path_depth to 1 and expose the search filter. The V2 fields endpoint refuses an unbounded walk of the tree (\"root path with path depth greater than 1 is not supported for V2 without a search filter\"), so the bare call returned HTTP 400. | 1.1.0 — Add the Alert Triage API (/idr/at): search alerts, get an alert, its evidence, its actors and its process trees, plus the tenant's alert field catalogue. These carry the detection content the investigation endpoints do not — MITRE T-codes, matched rule keys, assets and accounts, command lines. MDR-gated. | 1.0.0 — Initial release: investigation ingestion (list_investigations) with an exhaustive OCSF mapper, 18 commands across investigations, alerts, custom threats, logs/LEQL search and users. API v1/v2 selectable per instance and per command."
 category: siem
 
 # Per-instance configuration. The Insight platform region selects the API host
@@ -401,12 +401,13 @@ commands:
 
   - id: list_alert_fields
     name: rapid7-insight-idr-list-alert-fields
-    description: "List the alert fields supported by the tenant (Alert Triage API v2). Field ids are dotted paths (process.cmd_line, …) and are what search_alerts and get_alert accept in field_ids — run this first to learn which ones this tenant exposes."
+    description: "List the alert fields supported by the tenant (Alert Triage API v2). Field ids are dotted paths (process.cmd_line, …) and are what search_alerts and get_alert accept in field_ids — run this first to learn which ones this tenant exposes. With no path, search or path_depth the command lists the top-level nodes: the API refuses an unbounded walk of the whole tree."
     risk: read
     inputs_schema:
       properties:
-        path: { type: string, description: "Limit results to fields at or below this node of the dotted hierarchy" }
-        path_depth: { type: string, description: "Depth to round results to, after path is applied" }
+        path: { type: string, description: "Limit results to descendants of this node of the dotted hierarchy (e.g. process)" }
+        path_depth: { type: string, description: "Depth to round results to, after path is applied (e.g. path=process with depth 1 returns process.cmd_line). Defaults to 1 when neither path nor search is given, which the API requires." }
+        search: { type: string, description: "Case-insensitive substring the field must contain. Also lifts the depth restriction, so it is the way to search the whole tree at once (e.g. hostname)." }
         index: { type: string, description: "0-based page index" }
         page_size: { type: string, description: "Page size (default 200)" }
         limit: { type: number, description: "Maximum number of fields to retrieve" }
diff --git a/integrations/rapid7-insightidr/scripts/list_alert_fields.py b/integrations/rapid7-insightidr/scripts/list_alert_fields.py
index 7c85cd8..0fc072f 100644
--- a/integrations/rapid7-insightidr/scripts/list_alert_fields.py
+++ b/integrations/rapid7-insightidr/scripts/list_alert_fields.py
@@ -45,9 +45,20 @@ def run():
     # /alerts/fields is deprecated in favour of /alerts/2/fields. Field ids are
     # dotted paths (process.cmd_line, …) and are what search_alerts and
     # get_alert accept in field_ids — this command is how you discover them.
+    path = inp.get("path")
+    search = inp.get("search")
+    depth = inp.get("path_depth")
+    if not depth and not path and not search:
+        # V2 refuses an unbounded walk of the whole tree: "root path with path
+        # depth greater than 1 is not supported for V2 without a search filter".
+        # So the bare call — the one an operator makes first, to see what exists
+        # — has to name a depth. 1 lists the top-level nodes, and `path` or
+        # `search` is how you go deeper from there.
+        depth = 1
     out = request("GET", AT + "alerts/2/fields", params={
-        "path": inp.get("path"),
-        "path_depth": inp.get("path_depth"),
+        "path": path,
+        "path_depth": depth,
+        "search": search,
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or inp.get("limit") or 200,
     })