diff --git a/integrations/rapid7-insightidr/manifest.yaml b/integrations/rapid7-insightidr/manifest.yaml
index dca89df..77b821f 100644
--- a/integrations/rapid7-insightidr/manifest.yaml
+++ b/integrations/rapid7-insightidr/manifest.yaml
@@ -1,8 +1,8 @@
 id: rapid7_insightidr
 name: Rapid7 InsightIDR
-version: 1.11.0
+version: 1.11.1
 description: "Rapid7 InsightIDR (REST API) — investigation ingestion and full lifecycle (list/get/search/create/update/assign/set-status/bulk-close), investigation alerts and Rapid7 product alerts, custom threat indicators (add/replace), log management and LEQL log/log-set queries with downloads, and user directory search."
-changelog: "1.11.0 — Build one evidence row per alert evidence into custom:rapid7_evidence, for the table field: sortable and filterable where the Markdown summary only reads. | 1.10.0 — Render every detection key as Markdown into custom:rapid7_summary, so a layout can show what the OCSF catalogue has no field for. Map both ends of an account action, read source_json top-level scalars, drop placeholder values, and force evidences to stay an array. | 1.9.2 — Read the evidence data in both of its shapes. A parsed source states its event flat, with no source_data/custom_data wrapper, and the parser returned {} for all of them. | 1.9.1 — get_alert_process_trees: explain the 404, which the API returns with an empty body for three different situations. | 1.9.0 — Fetch each alert process tree and flatten it into ctx.process_tree, the shape the layout Process Tree block reads. Gated on the event type by default, since an authentication alert never has one. | 1.8.0 — Fetch each alert evidence at ingestion and parse it: the log line behind the alert lives in a JSON-encoded string no mapper can reach, and it is where the source and destination addresses, the account and the device actually are. | 1.7.0 — Map source/destination assets and accounts to src_endpoint, dst_endpoint, actor.user and user. A connection rule names both ends and neither is \"the host\", so an RDP-to-DC alert produced no entity at all and nothing a layout could show. | 1.6.0 — Surface region_failures: the Alert Triage API answers HTTP 200 with a partial result when it cannot reach a region, and that list was being dropped. Also report the regions seen in the RRNs against the configured one. | 1.5.0 — Flatten the whole of rule_keys_of_interest into the context. It is an open vocabulary — a process rule and an authentication rule share no keys — so the hardcoded list only covered rules already seen and left every other alert empty. | 1.4.1 — Read the alert RRN from `rrn` before `id` and drop anything not RRN-shaped: the investigation alert list also returns bare UUIDs, and one of those rejects the entire /alerts/ops/rrns batch (HTTP 400), losing every alert in the run. | 1.4.0 — Add get_investigations_full: the investigation with its alerts inlined, so it stays the unit that becomes an incident. Drop-in for list_investigations (results_path data, dedup rrn). | 1.3.0 — Add search_investigation_alerts: ingest only the alerts that belong to an investigation, with their full detection content, in 1+N+1 calls. Filtering search_alerts on investigation_rrn does not work — the term is accepted and silently matches nothing. | 1.2.1 — search_alerts: report a malformed terms_json with the input named and echoed, instead of json's bare \"Expecting value: line 1 column 1\". | 1.2.0 — Add the search_alerts OCSF mapper: rule_keys_of_interest carries the host, the process, its command line, its parent and the file hashes, so an alert-based feed indexes entities where the investigation feed indexed none. Validated against a live ABA alert. | 1.1.1 — list_alert_fields: default path_depth to 1 and expose the search filter. The V2 fields endpoint refuses an unbounded walk of the tree (\"root path with path depth greater than 1 is not supported for V2 without a search filter\"), so the bare call returned HTTP 400. | 1.1.0 — Add the Alert Triage API (/idr/at): search alerts, get an alert, its evidence, its actors and its process trees, plus the tenant's alert field catalogue. These carry the detection content the investigation endpoints do not — MITRE T-codes, matched rule keys, assets and accounts, command lines. MDR-gated. | 1.0.0 — Initial release: investigation ingestion (list_investigations) with an exhaustive OCSF mapper, 18 commands across investigations, alerts, custom threats, logs/LEQL search and users. API v1/v2 selectable per instance and per command."
+changelog: "1.11.1 — Strip the whitespace out of the comma-separated filter params (statuses, priorities, sources, tags) before the URL. \"HIGH, CRITICAL\" as typed sent \" CRITICAL\" to the API, which rejects the whole call — so a priority filter written naturally fetched nothing. | 1.11.0 —Build one evidence row per alert evidence into custom:rapid7_evidence, for the table field: sortable and filterable where the Markdown summary only reads. | 1.10.0 — Render every detection key as Markdown into custom:rapid7_summary, so a layout can show what the OCSF catalogue has no field for. Map both ends of an account action, read source_json top-level scalars, drop placeholder values, and force evidences to stay an array. | 1.9.2 — Read the evidence data in both of its shapes. A parsed source states its event flat, with no source_data/custom_data wrapper, and the parser returned {} for all of them. | 1.9.1 — get_alert_process_trees: explain the 404, which the API returns with an empty body for three different situations. | 1.9.0 — Fetch each alert process tree and flatten it into ctx.process_tree, the shape the layout Process Tree block reads. Gated on the event type by default, since an authentication alert never has one. | 1.8.0 — Fetch each alert evidence at ingestion and parse it: the log line behind the alert lives in a JSON-encoded string no mapper can reach, and it is where the source and destination addresses, the account and the device actually are. | 1.7.0 — Map source/destination assets and accounts to src_endpoint, dst_endpoint, actor.user and user. A connection rule names both ends and neither is \"the host\", so an RDP-to-DC alert produced no entity at all and nothing a layout could show. | 1.6.0 — Surface region_failures: the Alert Triage API answers HTTP 200 with a partial result when it cannot reach a region, and that list was being dropped. Also report the regions seen in the RRNs against the configured one. | 1.5.0 — Flatten the whole of rule_keys_of_interest into the context. It is an open vocabulary — a process rule and an authentication rule share no keys — so the hardcoded list only covered rules already seen and left every other alert empty. | 1.4.1 — Read the alert RRN from `rrn` before `id` and drop anything not RRN-shaped: the investigation alert list also returns bare UUIDs, and one of those rejects the entire /alerts/ops/rrns batch (HTTP 400), losing every alert in the run. | 1.4.0 — Add get_investigations_full: the investigation with its alerts inlined, so it stays the unit that becomes an incident. Drop-in for list_investigations (results_path data, dedup rrn). | 1.3.0 — Add search_investigation_alerts: ingest only the alerts that belong to an investigation, with their full detection content, in 1+N+1 calls. Filtering search_alerts on investigation_rrn does not work — the term is accepted and silently matches nothing. | 1.2.1 — search_alerts: report a malformed terms_json with the input named and echoed, instead of json's bare \"Expecting value: line 1 column 1\". | 1.2.0 — Add the search_alerts OCSF mapper: rule_keys_of_interest carries the host, the process, its command line, its parent and the file hashes, so an alert-based feed indexes entities where the investigation feed indexed none. Validated against a live ABA alert. | 1.1.1 — list_alert_fields: default path_depth to 1 and expose the search filter. The V2 fields endpoint refuses an unbounded walk of the tree (\"root path with path depth greater than 1 is not supported for V2 without a search filter\"), so the bare call returned HTTP 400. | 1.1.0 — Add the Alert Triage API (/idr/at): search alerts, get an alert, its evidence, its actors and its process trees, plus the tenant's alert field catalogue. These carry the detection content the investigation endpoints do not — MITRE T-codes, matched rule keys, assets and accounts, command lines. MDR-gated. | 1.0.0 — Initial release: investigation ingestion (list_investigations) with an exhaustive OCSF mapper, 18 commands across investigations, alerts, custom threats, logs/LEQL search and users. API v1/v2 selectable per instance and per command."
 category: siem
 
 # Per-instance configuration. The Insight platform region selects the API host
diff --git a/integrations/rapid7-insightidr/scripts/get_investigations_full.py b/integrations/rapid7-insightidr/scripts/get_investigations_full.py
index 056874f..d732022 100644
--- a/integrations/rapid7-insightidr/scripts/get_investigations_full.py
+++ b/integrations/rapid7-insightidr/scripts/get_investigations_full.py
@@ -477,8 +477,10 @@ def run():
     inv_page = request("GET", "idr/v2/investigations", params={
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or limit,
-        "statuses": inp.get("statuses"),
-        "priorities": inp.get("priorities"),
+        # ",".join(_list(...)): the API rejects the whole call when a list value
+        # carries whitespace, so "HIGH, CRITICAL" as typed must lose its space.
+        "statuses": ",".join(_list(inp.get("statuses"))) or None,
+        "priorities": ",".join(_list(inp.get("priorities"))) or None,
         "start_time": start_time,
         "end_time": inp.get("end_time"),
         "sort_field": "Created time",
diff --git a/integrations/rapid7-insightidr/scripts/list_investigations.py b/integrations/rapid7-insightidr/scripts/list_investigations.py
index e79cc05..a35d522 100644
--- a/integrations/rapid7-insightidr/scripts/list_investigations.py
+++ b/integrations/rapid7-insightidr/scripts/list_investigations.py
@@ -19,6 +19,16 @@ def _inputs():
     return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
 
 
+def _csv(v):
+    # The API rejects the whole call when a list value carries whitespace, so
+    # "HIGH, CRITICAL" as typed must become "HIGH,CRITICAL" before the URL.
+    if isinstance(v, list):
+        parts = [str(x).strip() for x in v]
+    else:
+        parts = [p.strip() for p in str(v or "").split(",")]
+    return ",".join(p for p in parts if p) or None
+
+
 def _api_version(inp, is_v2):
     v = str(inp.get("api_version") or "Default").strip()
     return v if v in ("V1", "V2") else ("V2" if is_v2 else "V1")
@@ -65,18 +75,18 @@ def run():
     params = {
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or limit,
-        "statuses": inp.get("statuses"),
+        "statuses": _csv(inp.get("statuses")),
         "start_time": start_time,
         "end_time": end_time,
     }
     if api_version == "V2":
         params.update({
-            "sources": inp.get("sources"),
-            "priorities": inp.get("priorities"),
+            "sources": _csv(inp.get("sources")),
+            "priorities": _csv(inp.get("priorities")),
             "assignee_email": inp.get("assignee_email"),
             "sort_field": inp.get("sort_field"),
             "sort_direction": inp.get("sort_direction"),
-            "tags": inp.get("tags"),
+            "tags": _csv(inp.get("tags")),
             "multi-customer": "true" if multi else None,
         })
     endpoint = "idr/" + api_version.lower() + "/investigations"
diff --git a/integrations/rapid7-insightidr/scripts/search_investigation_alerts.py b/integrations/rapid7-insightidr/scripts/search_investigation_alerts.py
index bdd569c..f4a8191 100644
--- a/integrations/rapid7-insightidr/scripts/search_investigation_alerts.py
+++ b/integrations/rapid7-insightidr/scripts/search_investigation_alerts.py
@@ -121,8 +121,10 @@ def run():
     inv_page = request("GET", "idr/v2/investigations", params={
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or limit,
-        "statuses": inp.get("statuses"),
-        "priorities": inp.get("priorities"),
+        # ",".join(_list(...)): the API rejects the whole call when a list value
+        # carries whitespace, so "HIGH, CRITICAL" as typed must lose its space.
+        "statuses": ",".join(_list(inp.get("statuses"))) or None,
+        "priorities": ",".join(_list(inp.get("priorities"))) or None,
         "start_time": start_time,
         "end_time": inp.get("end_time"),
         "sort_field": "Created time",