fix(rapid7-insightidr): make list_alert_fields callable with no arguments (v1.1.1)

The bare call answered HTTP 400:

  root path with path depth greater than 1 is not supported for V2
  without a search filter

Sending neither path nor path_depth asks the V2 fields endpoint to walk the
whole hierarchy from the root, which it refuses. That is exactly the call an
operator makes first — open the command, run it, see what the tenant exposes —
so the one entry point into this API failed on its most obvious use.

Default path_depth to 1 when neither path nor search is given: the top-level
nodes come back, and `path` drills down from there. Also expose the `search`
query parameter, which was missing from the command entirely and which lifts
the depth restriction — it is the way to look through the whole tree at once
for a field whose branch you do not know yet (search=hostname).

Found by running the command against a live tenant. The 400 also settles the
open question from v1.1.0: the API answered a validation error rather than
403, so the Alert Triage API is reachable with this key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/rapid7-insightidr/manifest.yaml

@@ -1,8 +1,8 @@
 id: rapid7_insightidr
 name: Rapid7 InsightIDR
-version: 1.1.0
+version: 1.1.1
 description: "Rapid7 InsightIDR (REST API) — investigation ingestion and full lifecycle (list/get/search/create/update/assign/set-status/bulk-close), investigation alerts and Rapid7 product alerts, custom threat indicators (add/replace), log management and LEQL log/log-set queries with downloads, and user directory search."
-changelog: "1.1.0 — Add the Alert Triage API (/idr/at): search alerts, get an alert, its evidence, its actors and its process trees, plus the tenant's alert field catalogue. These carry the detection content the investigation endpoints do not — MITRE T-codes, matched rule keys, assets and accounts, command lines. MDR-gated. | 1.0.0 — Initial release: investigation ingestion (list_investigations) with an exhaustive OCSF mapper, 18 commands across investigations, alerts, custom threats, logs/LEQL search and users. API v1/v2 selectable per instance and per command."
+changelog: "1.1.1 — list_alert_fields: default path_depth to 1 and expose the search filter. The V2 fields endpoint refuses an unbounded walk of the tree (\"root path with path depth greater than 1 is not supported for V2 without a search filter\"), so the bare call returned HTTP 400. | 1.1.0 — Add the Alert Triage API (/idr/at): search alerts, get an alert, its evidence, its actors and its process trees, plus the tenant's alert field catalogue. These carry the detection content the investigation endpoints do not — MITRE T-codes, matched rule keys, assets and accounts, command lines. MDR-gated. | 1.0.0 — Initial release: investigation ingestion (list_investigations) with an exhaustive OCSF mapper, 18 commands across investigations, alerts, custom threats, logs/LEQL search and users. API v1/v2 selectable per instance and per command."
 category: siem
 
 # Per-instance configuration. The Insight platform region selects the API host
@@ -401,12 +401,13 @@ commands:
 
   - id: list_alert_fields
     name: rapid7-insight-idr-list-alert-fields
-    description: "List the alert fields supported by the tenant (Alert Triage API v2). Field ids are dotted paths (process.cmd_line, …) and are what search_alerts and get_alert accept in field_ids — run this first to learn which ones this tenant exposes."
+    description: "List the alert fields supported by the tenant (Alert Triage API v2). Field ids are dotted paths (process.cmd_line, …) and are what search_alerts and get_alert accept in field_ids — run this first to learn which ones this tenant exposes. With no path, search or path_depth the command lists the top-level nodes: the API refuses an unbounded walk of the whole tree."
     risk: read
     inputs_schema:
       properties:
-        path: { type: string, description: "Limit results to fields at or below this node of the dotted hierarchy" }
-        path_depth: { type: string, description: "Depth to round results to, after path is applied" }
+        path: { type: string, description: "Limit results to descendants of this node of the dotted hierarchy (e.g. process)" }
+        path_depth: { type: string, description: "Depth to round results to, after path is applied (e.g. path=process with depth 1 returns process.cmd_line). Defaults to 1 when neither path nor search is given, which the API requires." }
+        search: { type: string, description: "Case-insensitive substring the field must contain. Also lifts the depth restriction, so it is the way to search the whole tree at once (e.g. hostname)." }
         index: { type: string, description: "0-based page index" }
         page_size: { type: string, description: "Page size (default 200)" }
         limit: { type: number, description: "Maximum number of fields to retrieve" }