From 812310088e415e889f459b8a12ebce44aa388a72 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Mon, 27 Jul 2026 10:30:50 -0400
Subject: [PATCH] Support sigma playbooks for airgap

---
 salt/soc/defaults.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index c89b39dcf..2553f17e7 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1512,6 +1512,10 @@ soc:
                 rulesetName: sos-resources-ag
                 branch: main
                 folder: securityonion-normalized
+              - repo: file:///nsm/airgap-resources/playbooks/securityonion-resources-playbooks
+                rulesetName: sos-published-ag
+                branch: published
+                folder: sigma
         assistant:
           systemPromptAddendum: ""
           systemPromptAddendumMaxLength: 50000