f3nris fb560cc937 rapid7-insightidr 1.14.8: user_authentications counts the user's own logons ...

The keyword search matches the account name anywhere in a line, so it brought
other accounts' logons: on a real run the only "new" event reported was
another user's failed password. Only events whose account/user field is the
user (DOMAIN\\user and user@domain normalized) are summarized now, with
keyword_matches and user_matches both reported. A first authentication is
recognized as Rapid7 flags it, a boolean new_authentication field, as well as
the word. The event limit cannot be set below 10000 (the agent passed 1000).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

2026-10-12 07:53:57 +00:00

..

operator.yaml

rapid7-insightidr 1.14.8: user_authentications counts the user's own logons

2026-10-12 07:53:57 +00:00