From 23f04e28665af7569a7e837f5c66db87547a0c21 Mon Sep 17 00:00:00 2001 From: Matthew Wright Date: Mon, 15 Jun 2026 11:40:01 -0400 Subject: [PATCH 1/3] maxSubSessionTokens and maxDelegationDepth config settings --- salt/soc/defaults.yaml | 2 ++ salt/soc/soc_soc.yaml | 10 ++++++++++ 2 files changed, 12 insertions(+) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 7e8e76094..afb4c37d1 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1509,6 +1509,8 @@ soc: assistant: systemPromptAddendum: "" systemPromptAddendumMaxLength: 50000 + maxSubSessionTokens: 0 + maxDelegationDepth: 0 adapters: - name: SOAI protocol: securityonion_ai_cloud diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 19853196a..cf483c406 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -719,6 +719,16 @@ soc: description: Maximum length of the system prompt addendum. Longer prompts will be truncated. global: True advanced: True + maxSubSessionTokens: + description: Maximum number of output tokens a delegated sub-session may generate across all of its turns. When the budget is reached, the sub-agent is halted and its result is returned to the parent agent. Set to 0 to disable the limit. + global: True + advanced: True + forcedType: int + maxDelegationDepth: + description: Maximum delegation nesting depth for sub-agents. For example, a value of 2 lets the main agent delegate to a sub-agent that may itself delegate one level deeper. Any deeper delegation is refused and the requesting agent continues without it. Set to 0 to disable the limit. + global: True + advanced: True + forcedType: int adapters: description: Configuration for AI adapters used by the Onion AI assistant. Please see documentation for help on which fields are required for which protocols. global: True From 8675296393aa3dd9b5f4f64177602546ec18cf00 Mon Sep 17 00:00:00 2001 From: Corey Ogburn Date: Wed, 1 Jul 2026 15:04:42 -0600 Subject: [PATCH 2/3] More Agentic Fields The big agentic switch, a specific maxDelegationDepth, and the agentMapping dict --- salt/soc/defaults.yaml | 6 +++++- salt/soc/soc_soc.yaml | 11 +++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index afb4c37d1..c751b25f4 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1510,7 +1510,7 @@ soc: systemPromptAddendum: "" systemPromptAddendumMaxLength: 50000 maxSubSessionTokens: 0 - maxDelegationDepth: 0 + maxDelegationDepth: 5 adapters: - name: SOAI protocol: securityonion_ai_cloud @@ -1522,6 +1522,10 @@ soc: serviceAccountJSON: "" serviceAccountLocation: "" healthTimeoutSeconds: 5 + agentic: false + agentMapping: + Orchestrator: sonnet + Hunter: sonnet onionconfig: saltstackDir: /opt/so/saltstack bypassEnabled: false diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index cf483c406..a11f8e0e4 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -767,6 +767,17 @@ soc: label: Health Timeout Seconds required: False forcedType: int + agentic: + description: Indicates if the Assistant Module should operate in agentic mode or not. If true, agents can work together to solve tasks. + global: True + forcedType: bool + agentMapping: + Orchestrator: + description: The initial agent in most agentic conversations. This agent will delegate requests to specialized agents. + global: True + Hunter: + description: This agent is specialized in querying events. + global: True client: assistant: enabled: From 83cf1f0793efaf8ee446e216698eebb37bd842cb Mon Sep 17 00:00:00 2001 From: Corey Ogburn Date: Thu, 2 Jul 2026 10:11:52 -0600 Subject: [PATCH 3/3] New Client Params for Tool Retries --- salt/soc/defaults.yaml | 2 ++ salt/soc/soc_soc.yaml | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index c751b25f4..490a09e3c 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -2695,6 +2695,8 @@ soc: thresholdColorRatioLow: 0.5 thresholdColorRatioMed: 0.75 thresholdColorRatioMax: 1 + toolBusyMaxRetries: 30 + toolBusyRetryDelayMs: 1000 availableModels: - id: sonnet displayName: Claude Sonnet diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index a11f8e0e4..5e171cd43 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -784,6 +784,12 @@ soc: description: Set to true to enable the Onion AI assistant in SOC. global: True forcedType: bool + toolBusyMaxRetries: + description: How many times to retry auto approving a tool while a tool is already running. + global: True + toolBusyRetryDelayMs: + description: How long in milliseconds to wait between each retry when auto approving a tool. + global: True investigationPrompt: description: Prompt given to Onion AI when beginning an investigation. global: True