From 26f5d07435a20a32349a7b60ceac641d08d9e458 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 13 Oct 2026 17:35:22 -0400 Subject: [PATCH] Remove the Notifier agent mapping AlertTriage now sends its own notification through the Notify skill, so the Notifier agent no longer exists in SOC. --- salt/soc/defaults.yaml | 1 - salt/soc/soc_soc.yaml | 5 +---- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 2b214cf7f..391b36194 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1545,7 +1545,6 @@ soc: Investigator: haiku@SOAI DetectionEngineer: haiku@SOAI AlertTriage: haiku@SOAI - Notifier: haiku@SOAI useMemory: false useMemoryScanner: false dontScanBefore: "" diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 99840fbcf..cd85b9ca6 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -954,10 +954,7 @@ soc: description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content. global: True AlertTriage: - description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases. - global: True - Notifier: - description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action. + description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can send a notification but cannot acknowledge alerts or escalate to cases. global: True useMemory: description: Enables the Memory system for OnionAI