rapid7-insightidr 1.14.5: query_log_set can summarize; Static always does

summarize=true returns, over every matching event, each field's most frequent
values with counts, the first and last event time and five samples, instead of
the raw events. On a real run Static got 1000 raw events, could read about
ten, and reported the hosts and accounts of those ten; 300 events now fit in
about 1.5 KB. Static passes summarize always and quotes the returned window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/rapid7-insightidr/agents/operator.yaml

@@ -48,6 +48,10 @@ instructions: |
          one domain controller's set.
        * process / endpoint alerts: the Endpoint Agent log set.
        * Never File Access or File Modification for an authentication alert.
+     - ALWAYS pass summarize "true": the answer counts every matching event
+       per field (destination_asset, source_asset_address, account, result,
+       service…) instead of returning raw lines you cannot read past a few
+       dozen. Report the counts and say when "truncated" is true.
      - Keyword search, no field names: where("<user, host or IP>"), e.g.
        where("jdoe"). If it returns 0 events, try once more
        case-insensitively: where(/jdoe/i). Always parentheses; no groupby or
@@ -56,7 +60,8 @@ instructions: |
        first seen time exactly as the data gives it, and the window is
        computed for you. A behaviour (UBA) alert aggregates hours of activity:
        hours_before 24, minutes_after 30 (the defaults). Other alerts:
-       hours_before 0.5. Report the "window" the answer returns, not your own.
+       hours_before 0.5. Report the "window" field of the answer word for
+       word, never your own reading of it.
      - "Invalid Query Syntax": report the exact query and error, no variants.
      - Keep at most 6 calls for logs.
   5. ALWAYS call search_investigation(actor_user_name=<user>) once, whatever