rapid7-insightidr 1.14.5: query_log_set can summarize; Static always does

summarize=true returns, over every matching event, each field's most frequent
values with counts, the first and last event time and five samples, instead of
the raw events. On a real run Static got 1000 raw events, could read about
ten, and reported the hosts and accounts of those ten; 300 events now fit in
about 1.5 KB. Static passes summarize always and quotes the returned window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ
This commit is contained in:
2026-10-12 07:18:09 +00:00
parent 847f31ce17
commit 889cf660f6
3 changed files with 87 additions and 3 deletions
File diff suppressed because one or more lines are too long