diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common
index 402ae97f3..be5a327f0 100755
--- a/salt/common/tools/sbin/so-image-common
+++ b/salt/common/tools/sbin/so-image-common
@@ -47,20 +47,17 @@ container_list() {
TRUSTED_CONTAINERS=(
"so-acng"
"so-curator"
- "so-domainstats"
"so-elastalert"
"so-elasticsearch"
"so-filebeat"
"so-fleet"
"so-fleet-launcher"
- "so-freqserver"
"so-grafana"
"so-idstools"
"so-influxdb"
"so-kibana"
"so-kratos"
"so-logstash"
- "so-minio"
"so-mysql"
"so-nginx"
"so-pcaptools"
diff --git a/salt/soc/files/soc/changes.json b/salt/soc/files/soc/changes.json
deleted file mode 100644
index dbc7b4061..000000000
--- a/salt/soc/files/soc/changes.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
- "title": "Security Onion 2.3.40 is here!",
- "changes": [
- { "summary": "FEATURE: Add option for HTTP Method Specification/POST to Hunt/Alerts Actions #2904" },
- { "summary": "FEATURE: Add option to configure proxy for various tools used during setup + persist the proxy configuration #529" },
- { "summary": "FEATURE: Alerts/Hunt - Provide method for base64-encoding pivot value #1749" },
- { "summary": "FEATURE: Allow users to customize links in SOC #1248" },
- { "summary": "FEATURE: Display user who requested PCAP in SOC #2775" },
- { "summary": "FEATURE: Make SOC browser app connection timeouts adjustable #2408" },
- { "summary": "FEATURE: Move to FleetDM #3483" },
- { "summary": "FEATURE: Reduce field cache expiration from 1d to 5m, and expose value as a salt pillar #3537" },
- { "summary": "FEATURE: Refactor docker_clean salt state to use loop w/ inspection instead of hardcoded image list #3113" },
- { "summary": "FEATURE: Run so-ssh-harden during setup #1932" },
- { "summary": "FEATURE: SOC should only display links to tools that are enabled #1643" },
- { "summary": "FEATURE: Update Sigmac Osquery Field Mappings #3137" },
- { "summary": "FEATURE: User must accept the Elastic licence during setup #3233" },
- { "summary": "FEATURE: soup should output more guidance for distributed deployments at the end #3340" },
- { "summary": "FEATURE: soup should provide some initial information and then prompt the user to continue #3486" },
- { "summary": "FIX: Add cronjob for so-suricata-eve-clean script #3515" },
- { "summary": "FIX: Change Elasticsearch heap formula #1686" },
- { "summary": "FIX: Create a post install version loop in soup #3102" },
- { "summary": "FIX: Custom Kibana settings are not being applied properly on upgrades #3254" },
- { "summary": "FIX: Hunt query issues with quotes #3320" },
- { "summary": "FIX: IP Addresses don't work with .security #3327" },
- { "summary": "FIX: Improve DHCP leases query in Hunt #3395" },
- { "summary": "FIX: Improve Setup verbiage #3422" },
- { "summary": "FIX: Improve Suricata DHCP logging and parsing #3397" },
- { "summary": "FIX: Keep RELATED,ESTABLISHED rules at the top of iptables chains #3288" },
- { "summary": "FIX: Populate http.status_message field #3408" },
- { "summary": "FIX: Remove 'types removal' deprecation messages from elastic log. #3345" },
- { "summary": "FIX: Reword + fix formatting on ES data storage prompt #3205" },
- { "summary": "FIX: SMTP shoud read SNMP on Kibana SNMP view #3413" },
- { "summary": "FIX: Sensors can temporarily show offline while processing large PCAP jobs #3279" },
- { "summary": "FIX: Soup should log to the screen as well as to a file #3467" },
- { "summary": "FIX: Strelka port 57314 not immediately relinquished upon restart #3457" },
- { "summary": "FIX: Switch SOC to pull from fieldcaps API due to field caching changes in Kibana 7.11 #3502" },
- { "summary": "FIX: Syntax error in /etc/sysctl.d/99-reserved-ports.conf #3308" },
- { "summary": "FIX: Telegraf hardcoded to use https and is not aware of elasticsearch features #2061" },
- { "summary": "FIX: Zeek Index Close and Delete Count for curator #3274" },
- { "summary": "FIX: so-cortex-user-add and so-cortex-user-enable use wrong pillar value for api key #3388" },
- { "summary": "FIX: so-rule does not completely apply change #3289" },
- { "summary": "FIX: soup should recheck disk space after it tries to clean up. #3235" },
- { "summary": "UPGRADE: Elastic 7.11.2 #3389" },
- { "summary": "UPGRADE: Suricata 6.0.2 #3217" },
- { "summary": "UPGRADE: Zeek 4 #3216" },
- { "summary": "UPGRADE: Zeek container to use Python 3 #1113" },
- { "summary": "UPGRADE: docker-ce to latest #3493" }
- ]
-}
\ No newline at end of file
diff --git a/salt/soc/files/soc/motd.md b/salt/soc/files/soc/motd.md
new file mode 100644
index 000000000..295329f39
--- /dev/null
+++ b/salt/soc/files/soc/motd.md
@@ -0,0 +1,25 @@
+## Getting Started
+
+New to Security Onion 2? Check out the [Online Help](/docs/) and [Cheatsheet](/docs/cheatsheet.pdf) to learn how to best utilize Security Onion to hunt for evil! Find them in the upper-right menu.
+
+If you're ready to dive-in, take a look at the [Alerts](/#/alerts) interface to see what Security Onion has detected so far. Or navigate to the [Hunt](/#/hunt) interface to hunt for evil that the alerts might have missed!
+
+## What's New
+
+The release notes have moved to the upper-right menu. Click on the [What's New](/docs/#document-release-notes) menu option to find all the latest fixes and features in this version of Security Onion!
+
+## Customize This Space
+
+Make this area your own by customizing the content. The content is stored in the `motd.md` file, which uses the common Markdown (.md) format. Visit [mardownguide.org](https://www.markdownguide.org/) to learn more about the simple Markdown format.
+
+To customize this content, login to the manager via SSH and execute the following command:
+
+```bash
+cp -f /opt/so/saltstack/default/salt/soc/files/soc/motd.md /opt/so/saltstack/local/salt/soc/files/soc/motd.md
+```
+
+Now, edit the new file as desired. Finally, run this command:
+
+```bash
+salt-call state.apply soc queue=True
+```
diff --git a/salt/soc/init.sls b/salt/soc/init.sls
index d31898e72..a2d3ecf89 100644
--- a/salt/soc/init.sls
+++ b/salt/soc/init.sls
@@ -35,10 +35,10 @@ socconfig:
- mode: 600
- template: jinja
-socchanges:
+socmotd:
file.managed:
- - name: /opt/so/conf/soc/changes.json
- - source: salt://soc/files/soc/changes.json
+ - name: /opt/so/conf/soc/motd.md
+ - source: salt://soc/files/soc/motd.md
- user: 939
- group: 939
- mode: 600
@@ -61,7 +61,7 @@ so-soc:
- binds:
- /nsm/soc/jobs:/opt/sensoroni/jobs:rw
- /opt/so/conf/soc/soc.json:/opt/sensoroni/sensoroni.json:ro
- - /opt/so/conf/soc/changes.json:/opt/sensoroni/html/changes.json:ro
+ - /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro
- /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro
- /opt/so/log/soc/:/opt/sensoroni/logs/:rw
{%- if salt['pillar.get']('nodestab', {}) %}