rapid7-insightidr 1.14.7: user_authentications, one call for a UBA alert

A new read command answers what a behaviour authentication alert asks —
which assets the user authenticated to around the alert, and which were new —
in one call: it resolves the Asset Authentication log set, builds the
keyword query and the 24 h window itself, and summarizes all events and,
apart, those marked new_authentication. Across real runs gpt-oss mangled log
set ids, computed the window a day off, put a filter inside the LEQL (HTTP
400) and read ten lines out of a thousand; this leaves it nothing to get
wrong. Static calls it first for such alerts; list_investigation_alerts
points to it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/rapid7-insightidr/agents/operator.yaml

@@ -36,8 +36,15 @@ instructions: |
      investigation RRN (rrn:investigation:...), never an alert RRN.
   2. list_investigation_alerts(investigation_id=<that RRN>) (1 call).
   3. Alerts with evidence_api true: get_alert_actors, then get_alert_evidence.
-  4. Alerts with evidence_api false, and any alert whose evidence did not
-     answer: the logs.
+  4. A behaviour (UBA) alert about authentication — lateral movement, "new
+     assets", "Domain Credentials": call user_authentications(user=<the
+     account>, anchor_time=<the alert's first seen time, copied as given>)
+     ONCE. It does the search, the window and the split itself. Report its
+     "window" word for word, the totals from "all", and from
+     "new_authentications" the destination assets by name with their counts:
+     those are the new assets. Do not redo this search with query_log_set.
+     Other alerts with evidence_api false, or a question this does not
+     answer: the logs, as below.
      - list_log_sets (1 call) to see the names. Then query_log_set with
        log_set_name — the NAME, e.g. "Asset Authentication" — never a copied
        log_set_id: a 36-character id gets mangled in the copy.
@@ -80,6 +87,7 @@ instructions: |
   assets" the alert is about.
 
 commands:
+  - user_authentications
   - list_investigation_alerts
   - get_investigation
   - search_investigation