rapid7-insightidr 1.14.3: the log window is computed from the alert's time

query_log_set takes anchor_time with hours_before / minutes_after and computes
the window itself, and returns it as text: on a real run the agent computed
"24 hours before 2026-10-11T00:04Z" as ending on the 10th and reported a
day-old window. Static passes the alert's first seen time instead of dates,
and lists domain controllers apart from the new assets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/rapid7-insightidr/agents/operator.yaml

@@ -52,11 +52,11 @@ instructions: |
        where("jdoe"). If it returns 0 events, try once more
        case-insensitively: where(/jdoe/i). Always parentheses; no groupby or
        calculate.
-     - Window. A behaviour (UBA) alert aggregates activity over hours — its
-       count of "new assets" keeps growing after it is raised — so take the 24
-       hours before its first seen time, up to 30 minutes after its last seen
-       time. Other alerts: 30 minutes on each side. First and last seen can be
-       inverted in the data: take the earlier as the start.
+     - Window: never compute dates yourself. Pass anchor_time = the alert's
+       first seen time exactly as the data gives it, and the window is
+       computed for you. A behaviour (UBA) alert aggregates hours of activity:
+       hours_before 24, minutes_after 30 (the defaults). Other alerts:
+       hours_before 0.5. Report the "window" the answer returns, not your own.
      - "Invalid Query Syntax": report the exact query and error, no variants.
      - Keep at most 6 calls for logs.
   5. ALWAYS call search_investigation(actor_user_name=<user>) once, whatever
@@ -64,8 +64,10 @@ instructions: |
      start_time / end_time, not time_range; empty, it covers 28 days.
 
   In your answer, list the hosts and IPs the logs show for the user — that is
-  what an analyst needs from a "new assets" alert — and say which log set and
-  query produced them.
+  what an analyst needs from a "new assets" alert — and say which log set,
+  query and window produced them. Domain controllers (names with "dc") are
+  where every logon is checked: list them apart, they are not the "new
+  assets" the alert is about.
 
 commands:
   - list_investigation_alerts