Merge pull request #15161 from Security-Onion-Solutions/jertel/wip

add exclusion toggle

salt/soc/defaults.yaml

@@ -1638,6 +1638,9 @@ soc:
             - name: socExcludeToggle
               filter: 'NOT event.module:"soc"'
               enabled: true
+            - name: onionaiExcludeToggle
+              filter: 'NOT _index:"*:so-assistant-*"'
+              enabled: true
           queries:
             - name: Default Query
               description: Show all events grouped by the observer host