rapid7-insightidr 1.14.8: user_authentications counts the user's own logons

The keyword search matches the account name anywhere in a line, so it brought
other accounts' logons: on a real run the only "new" event reported was
another user's failed password. Only events whose account/user field is the
user (DOMAIN\\user and user@domain normalized) are summarized now, with
keyword_matches and user_matches both reported. A first authentication is
recognized as Rapid7 flags it, a boolean new_authentication field, as well as
the word. The event limit cannot be set below 10000 (the agent passed 1000).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/rapid7-insightidr/agents/operator.yaml

@@ -40,7 +40,9 @@ instructions: |
      assets", "Domain Credentials": call user_authentications(user=<the
      account>, anchor_time=<the alert's first seen time, copied as given>)
      ONCE. It does the search, the window and the split itself. Report its
-     "window" word for word, the totals from "all", and from
+     "window" word for word, user_matches (the user's own events —
+     keyword_matches includes other accounts' lines, never report those as
+     the user's), the totals from "all", and from
      "new_authentications" the destination assets by name with their counts:
      those are the new assets. Do not redo this search with query_log_set.
      Other alerts with evidence_api false, or a question this does not