G’day folks,
Since the 16th July 2025 InsightIDR platform update, we’ve spotted an odd change in Log Search:
Run any query with more than three groupby() keys, e.g.
where(event_type=“asset_authentication”)
groupby(destination_user, source_asset, result, source_ip)
The Analysis pane shows each row collapsed, displaying only the first result with an Expand caret for the rest.
The view resets on every refresh, so analysts must click hundreds of rows to view all values depending on the query.
I’ve checked the July 2025 release notes and earlier monthly notes, and I couldn’t see this called out which seems like a significant oversight?
Questions
- Is the collapse‑by‑default behaviour intentional or a bug?
- Is there a setting, feature flag or URL parameter to force rows to expand automatically?
- Any work‑arounds people are using (custom CSS, export, API, etc.)?
- Rapid7 team: can you confirm whether this is expected and, if so, whether a toggle will be added?
This extra clicking is significantly slowing down investigations for our SecOps team. Any guidance appreciated.
