rapid7-insightidr 1.14.4: keep UBA alerts in the full investigation feed

Browse Source

get_investigations_full dropped every alert without an RRN, so a behaviour
(UBA) investigation arrived with alerts: [] and alert_count: 0 and its
reading worked from a title alone. Those alerts are now kept under
alerts_without_rrn as the investigation endpoint returns them, counted in
alert_count, rendered in summary_markdown with where their evidence lives,
and lift first_alert_type / first_alert_source / first_alert_id when they are
all the investigation has.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

...

This commit is contained in:

Guillaume BOURGEOIS

2026-10-12 07:02:12 +00:00

parent 9605e1f0dc

commit 3e39f17bfe

2 changed files with 56 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

integrations/rapid7-insightidr/manifest.yaml

+2 -2

File diff suppressed because one or more lines are too long