rapid7-insightidr 1.14.1: mark UBA alerts in the data, give Static a budget

Browse Source

list_investigation_alerts now marks each alert with alert_rrn, evidence_api
and next: a behaviour alert with no RRN says, in the output the agent reads,
that the Alert Triage commands answer 404 for it and that its evidence is in
the authentication logs. Static still called them when only its instructions
said so. Its sheet gets 14 calls spent in a stated order, authentication log
sets for lateral-movement alerts (never file access), and a window built from
first and last seen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

...

This commit is contained in:

Guillaume BOURGEOIS

2026-10-11 22:20:58 +00:00

parent c5da537434

commit c3b15d1faf

3 changed files with 61 additions and 28 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

integrations/rapid7-insightidr/manifest.yaml

+1 -1

File diff suppressed because one or more lines are too long