f3nris 4bd468e671 rapid7-insightidr 1.14.2: query a log set by name; Static widens UBA windows ...

query_log_set accepts log_set_name and resolves the id itself (exact name, or
the one set whose name contains it; otherwise refused with the existing
names): on a real run the model mangled a 36-character id it copied. Static
queries by name, retries a 0-event keyword search case-insensitively, takes
the 24 hours before a behaviour alert (they aggregate hours of activity), and
always looks for the user's other investigations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

2026-10-11 22:32:22 +00:00

..

abuseipdb

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

active-directory

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

alienvault-otx

feat(alienvault-otx): new AlienVault OTX enrichment integration

2026-07-11 22:33:10 +02:00

anomali-threatstream

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

anyrun

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

armis

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

automox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

aws

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

axonius

feat(axonius): new Axonius asset-management integration

2026-07-12 14:41:43 +02:00

azure-security

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

beyondtrust-password-safe

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

binaryedge

feat(binaryedge): new BinaryEdge exposure-intel integration

2026-07-12 14:15:54 +02:00

box

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cape

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

carbon-black-cloud

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

censys

feat(censys): new Censys enrichment integration

2026-07-11 22:39:29 +02:00

checkpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

chronicle

feat(chronicle): new Google Chronicle SIEM integration

2026-07-12 00:25:51 +02:00

circl-hashlookup

docs(ioc-sources): suggest summary lines for Riposte context enrichment rules

2026-10-09 22:53:04 +00:00

cisco-fmc

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cisco-ise

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cisco-secure-endpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cisco-umbrella-enforcement

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cloudflare

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

confluence

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cortex-xdr

docs(mappers): MTTD is not retired, only re-anchored

2026-10-07 09:58:20 +00:00

crowdsec

feat(crowdsec): new CrowdSec CTI integration (French vendor)

2026-07-12 16:07:37 +02:00

crowdstrike

docs(mappers): MTTD is not retired, only re-anchored

2026-10-07 09:58:20 +00:00

crtsh

feat(crtsh): Cert Spotter fallback and a 60 s time budget (1.1.0)

2026-10-10 21:12:15 +00:00

cuckoo

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cybelangel

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cyberark-pas

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cybereason

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

darktrace

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

datadog

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

delinea-secret-server

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

discord

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

domaintools

feat(domaintools): new DomainTools DNS-intel integration

2026-07-12 21:59:05 +02:00

dropbox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

duo

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

eclecticiq

feat(eclecticiq): new EclecticIQ threat-intel integration

2026-07-12 15:49:16 +02:00

efficientip

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

elasticsearch

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

emailrep

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

extrahop

feat(extrahop): new ExtraHop Reveal(x) NDR integration

2026-07-12 00:48:03 +02:00

f5-bigip

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

feed-aws-ipranges

feat(feed): add AWS IP ranges feed connector (allowlist / known infra)

2026-07-13 12:08:48 +02:00

feed-blocklist-de

feat(feed): add Blocklist.de feed connector (fail2ban attacker lists)

2026-07-12 22:59:19 +02:00

feed-botvrij

feat(feed): add Botvrij.eu OSINT feed connector (IOC lists by type)

2026-07-13 12:15:50 +02:00

feed-cins-army

feat(feed): add CINS Army feed connector (CI Army bad-guys list)

2026-07-12 22:59:20 +02:00

feed-cisa-kev

feat(feed): add CISA KEV feed connector (known exploited vulnerabilities)

2026-07-13 12:12:34 +02:00

feed-cloudflare-ips

feat(feed): add Cloudflare IPs feed connector (allowlist / known infra)

2026-07-13 12:08:49 +02:00

feed-csv

feat(feed-csv): new generic CSV threat-intel feed connector

2026-07-12 22:43:16 +02:00

feed-dshield

feat(feed): add DShield block list feed connector (SANS ISC)

2026-07-12 22:59:18 +02:00

feed-emergingthreats

feat(feed): add Emerging Threats feed connector (ET Open reputation lists)

2026-07-12 23:02:11 +02:00

feed-feodotracker

feat(feed): add Feodo Tracker feed connector (abuse.ch C2 IP blocklist)

2026-07-12 22:49:28 +02:00

feed-first-epss

feat(feed): add FIRST EPSS feed connector (exploit-prediction scores)

2026-07-13 12:12:35 +02:00

feed-gcp-ipranges

feat(feed): add GCP IP ranges feed connector (allowlist / known infra)

2026-07-13 12:08:49 +02:00

feed-json

feat(feed): add generic JSON feed connector (configurable field mapping)

2026-07-12 23:02:10 +02:00

feed-nvd

feat(feed): add NVD CVE feed connector (recent CVEs, NVD 2.0 API)

2026-07-13 12:12:34 +02:00

feed-office365

feat(feed): add Microsoft 365 endpoints feed connector (allowlist / known infra)

2026-07-13 12:15:50 +02:00

feed-openphish

feat(feed): add OpenPhish feed connector (community phishing URLs)

2026-07-12 23:02:11 +02:00

feed-plaintext

feat(feed-plaintext): new generic plain-text threat-intel feed connector

2026-07-12 22:43:17 +02:00

feed-rss

feat(feed): add generic RSS/Atom IOC feed connector (URL/IP/hash extraction, defang-aware)

2026-07-13 12:15:49 +02:00

feed-spamhaus-drop

feat(feed): add Spamhaus DROP feed connector (DROP/DROPv6/ASN-DROP)

2026-07-12 22:49:30 +02:00

feed-sslbl

feat(feed): add SSL Blacklist feed connector (abuse.ch C2 IP/fingerprint lists)

2026-07-12 22:56:36 +02:00

feed-taxii2

feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector

2026-07-12 22:43:17 +02:00

feed-threatfox

feat(feed): add ThreatFox feed connector (abuse.ch IOC export)

2026-07-12 22:56:36 +02:00

feed-tor-exit

feat(feed): add Tor exit nodes feed connector

2026-07-12 22:49:29 +02:00

feed-urlhaus

feat(feed): add URLhaus feed connector (abuse.ch malware URL feed)

2026-07-12 22:56:35 +02:00

forcepoint-dlp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

fortigate

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

freshservice

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gatewatcher

feat(gatewatcher): new Gatewatcher AionIQ NDR integration (French vendor)

2026-07-12 16:12:38 +02:00

gcp-security

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

github

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gitlab

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

glimps

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gmail

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gmail-single-user

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

google-calendar

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

google-drive

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

graylog

feat(graylog): new Graylog log-search integration

2026-07-12 15:08:50 +02:00

greynoise

feat(greynoise): new GreyNoise enrichment integration

2026-07-11 22:33:09 +02:00

harfanglab

feat(harfanglab): describe an incident with the rule's message (1.7.1)

2026-10-07 19:11:35 +00:00

hibp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

hunter

feat(hunter): new Hunter.io email-OSINT integration

2026-07-12 14:15:53 +02:00

hybrid-analysis

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

imperva

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

infoblox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

intel471

feat(intel471): new Intel 471 threat-intel integration

2026-07-12 15:49:17 +02:00

intezer

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

intune

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

ipinfo

feat(ipinfo): support the Lite API for free/Lite plan tokens (v1.1.0)

2026-08-05 21:01:43 +02:00

ipqualityscore

feat(ipqualityscore): new IPQualityScore enrichment integration

2026-07-11 22:58:17 +02:00

jira

feat(jira): pick the project, issue type and priority from the site (1.3.0)

2026-10-02 10:16:41 +00:00

joe-sandbox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

jumpcloud

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mail-sender

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mailinblack

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

maltiverse

feat(maltiverse): new Maltiverse enrichment integration

2026-07-11 22:39:29 +02:00

malwarebazaar

feat(malwarebazaar): new MalwareBazaar sample-intel integration

2026-07-12 14:58:07 +02:00

mandiant

feat(mandiant): new Mandiant Advantage threat-intel integration

2026-07-12 00:15:12 +02:00

mattermost

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

meraki

feat(meraki): new Cisco Meraki network integration

2026-07-12 21:53:58 +02:00

microsoft-defender-endpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-defender-o365

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-entra-id

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-graph-files

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-purview

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-sentinel

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-teams

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mimecast

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

misp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mock-edr-s1

fix(mock-edr-s1): map the OCSF-shaped incident payload

2026-06-27 16:20:53 +02:00

netskope

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

okta

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

onelogin

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

opencti

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

openldap

feat(openldap): LDAP authentication integration (OpenLDAP / Active Directory)

2026-06-26 17:44:54 +02:00

opsgenie

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

ovhcloud

fix(ovhcloud): treat the billing-account list as advice, never as a verdict (1.2.6)

2026-09-19 19:29:09 +00:00

pagerduty

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

panos

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

pingone

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

prisma-cloud

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

proofpoint-tap

feat(proofpoint-tap): new Proofpoint TAP email-threat integration

2026-07-11 23:46:35 +02:00

pulsedive

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

qradar

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

qualys

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

ransomware-live

fix(ransomware-live): keyless — drop optional API key, no auth required

2026-07-15 19:18:49 +02:00

rapid7-insightidr

rapid7-insightidr 1.14.2: query a log set by name; Static widens UBA windows

2026-10-11 22:32:22 +00:00

rapid7-insightvm

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

rdap

docs(ioc-sources): suggest summary lines for Riposte context enrichment rules

2026-10-09 22:53:04 +00:00

recorded-future

feat(recorded-future): Recorded Future + ASI integrations

2026-06-27 15:19:40 +02:00

recorded-future-asi

feat(recorded-future): Recorded Future + ASI integrations

2026-06-27 15:19:40 +02:00

rocketchat

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

runzero

feat(runzero): new runZero asset-inventory integration

2026-07-12 14:41:42 +02:00

sailpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

scaleway

feat(scaleway): new Scaleway cloud integration (French vendor)

2026-07-12 21:37:31 +02:00

securitytrails

feat(securitytrails): new SecurityTrails enrichment integration

2026-07-11 22:48:48 +02:00

sekoia-intelligence-center

feat(sekoia): Sekoia XDR + SEKOIA Intelligence Center integrations

2026-06-27 15:04:22 +02:00

sekoia-xdr

fix(sekoia-xdr): mapper reviewed on a real alert (1.2.0)

2026-10-07 09:13:03 +00:00

sentinelone

feat(sentinelone): list the UAM alert statuses as an enum (1.18.0)

2026-10-01 20:26:45 +00:00

sentinelone-sdl

feat: SentinelOne SDL + VirusTotal Hunting integrations

2026-06-27 15:34:42 +02:00

servicenow

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

servicenow-cmdb

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

servicenow-iam

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

shodan

chore: bump ipinfo/shodan/virustotal to regenerate form-based scripts

2026-06-26 00:18:06 +02:00

signalsciences

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

slack

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

snyk

feat(snyk): new Snyk appsec-posture integration

2026-07-12 15:18:48 +02:00

sophos-central

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

splunk

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

stormshield

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

sumologic

feat(sumologic): new Sumo Logic log-search integration

2026-07-12 15:08:51 +02:00

symantec-dlp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

tehtris

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

telegram

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

tenable-io

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

thehive

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

thinkst-canary

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

threatconnect

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

threatfox

feat(threatfox): new ThreatFox IOC-intel integration

2026-07-12 14:58:07 +02:00

threatq

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

trend-vision-one

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

triage

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

twilio

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

urlhaus

feat(urlhaus): new URLhaus malicious-URL intel integration

2026-07-12 14:15:54 +02:00

urlscan

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

vade

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

vault

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

vectra

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

virustotal

feat(virustotal): complete v3 command coverage (script-based)

2026-06-27 15:53:22 +02:00

virustotal-hunting

feat: SentinelOne SDL + VirusTotal Hunting integrations

2026-06-27 15:34:42 +02:00

vmray

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

wallix-bastion

feat(wallix-bastion): new WALLIX Bastion PAM integration (French vendor)

2026-07-12 16:07:38 +02:00

webhook

feat(webhook): outbound webhooks to any third-party solution (v1.0.0)

2026-09-18 08:25:34 +00:00

withsecure

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

wiz

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

yaraify

feat(yaraify): new YARAify file/YARA-intel integration

2026-07-12 14:58:08 +02:00

zendesk

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

zscaler

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

zscaler-zpa

feat(zscaler-zpa): new Zscaler Private Access integration

2026-07-12 00:37:11 +02:00