f3nris ae1effafcd rapid7-insightidr 1.14.6: narrow a log result by field, no query syntax ...

query_log_set takes only="field=value[, …]", applied to the events' fields
after the search (case ignored), and says how many matched before it. Static
runs a second summary of the same query restricted to what the alert is about
— for a "new assets" alert, the new authentications — and names their
destination assets: the first real run summarized 978 events but left the 64
new ones mixed in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

2026-10-12 07:27:36 +00:00

..

agents

rapid7-insightidr 1.14.6: narrow a log result by field, no query syntax

2026-10-12 07:27:36 +00:00

incident-types

feat(rapid7-insightidr): InsightIDR integration (19 commands + OCSF ingestion)

2026-06-27 14:00:29 +02:00

mappers

docs(mappers): MTTD is not retired, only re-anchored

2026-10-07 09:58:20 +00:00

scripts

rapid7-insightidr 1.14.6: narrow a log result by field, no query syntax

2026-10-12 07:27:36 +00:00

manifest.yaml

rapid7-insightidr 1.14.6: narrow a log result by field, no query syntax

2026-10-12 07:27:36 +00:00