diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index c6e833d32..f51a938bc 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1465,6 +1465,7 @@ soc:
             - core
             - emerging_threats_addon
           useEsql: false
+          caseInsensitive: true
         elastic:
           hostUrl:
           remoteHostUrls: []
diff --git a/salt/soc/files/soc/sigma_so_pipeline.yaml b/salt/soc/files/soc/sigma_so_pipeline.yaml
index 64b691d8f..ae867be49 100644
--- a/salt/soc/files/soc/sigma_so_pipeline.yaml
+++ b/salt/soc/files/soc/sigma_so_pipeline.yaml
@@ -1,6 +1,31 @@
 name: Security Onion Baseline Pipeline
 priority: 90
 transformations:
+    # ES|QL scalar == returns null on multivalued fields; the
+    # backend reads this key and emits MV_INTERSECTS instead.
+    - id: declare_multivalue_fields
+      type: set_state
+      key: multivalue_fields
+      val:
+        - event.type
+        - event.action
+        - event.category
+        - tags
+        - process.args
+        - related.ip
+        - dns.resolved_ip
+    - id: esql_default_index
+      type: set_state
+      key: index
+      val: .ds-logs-*
+    - id: esql_source_metadata
+      type: set_state
+      key: metadata
+      val: "_id, _index, _source"
+    - id: esql_source_keep
+      type: set_state
+      key: keep
+      val: "_id, _index, _source"
     - id: baseline_field_name_mapping
       type: field_name_mapping
       mapping:
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index b329b736b..e49ad6ce7 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -396,6 +396,11 @@ soc:
             global: True
             advanced: True
             forcedType: bool
+          caseInsensitive:
+            description: "Match string values case-insensitively. Applies to ES|QL only."
+            global: True
+            advanced: True
+            forcedType: bool
         elastic:
           index:
             description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records.