f3nris 2245d5500e rapid7-insightidr 1.14.3: the log window is computed from the alert's time ...

query_log_set takes anchor_time with hours_before / minutes_after and computes
the window itself, and returns it as text: on a real run the agent computed
"24 hours before 2026-10-11T00:04Z" as ending on the 10th and reported a
day-old window. Static passes the alert's first seen time instead of dates,
and lists domain controllers apart from the new assets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

2026-10-11 22:38:42 +00:00

..

operator.yaml

rapid7-insightidr 1.14.3: the log window is computed from the alert's time

2026-10-11 22:38:42 +00:00