rapid7-insightidr 1.14.6: narrow a log result by field, no query syntax

query_log_set takes only="field=value[, …]", applied to the events' fields
after the search (case ignored), and says how many matched before it. Static
runs a second summary of the same query restricted to what the alert is about
— for a "new assets" alert, the new authentications — and names their
destination assets: the first real run summarized 978 events but left the 64
new ones mixed in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/rapid7-insightidr/agents/operator.yaml

@@ -62,6 +62,11 @@ instructions: |
        hours_before 24, minutes_after 30 (the defaults). Other alerts:
        hours_before 0.5. Report the "window" field of the answer word for
        word, never your own reading of it.
+     - Then isolate what the alert is about with a second summary of the SAME
+       query and window, adding only "<field>=<value>" with a field name and
+       value exactly as the first summary printed them. A "new assets" alert:
+       only the new authentications (e.g. authentication_type=
+       new_authentication) — its destination assets are the answer. Name them.
      - "Invalid Query Syntax": report the exact query and error, no variants.
      - Keep at most 6 calls for logs.
   5. ALWAYS call search_investigation(actor_user_name=<user>) once, whatever