From ff2b46b73e185bd87fc2ffc0131a1036c02b2b7b Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Wed, 14 Oct 2026 09:19:16 -0400
Subject: [PATCH] combine default and alerts queries added via pillar

pillar.get replaces lists, so once alerts queries are saved to pillar
from the SOC config UI, queries added to defaults later (e.g. the
licensed Group By Assessment, Name) never reach soc.json. Merge them by
name the same way availableModels are merged by id: pillar order and
edits are kept, and default queries missing from pillar are appended.
---
 salt/soc/merged.map.jinja | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
index 8f0ec025a..f5d3232a9 100644
--- a/salt/soc/merged.map.jinja
+++ b/salt/soc/merged.map.jinja
@@ -22,7 +22,7 @@
 {% do SOCMERGED.config.server.update({'additionalCA': MANAGERMERGED.additionalCA}) %}
 {% do SOCMERGED.config.server.update({'insecureSkipVerify': MANAGERMERGED.insecureSkipVerify}) %}
 
-{# pillar.get replaces lists instead of merging them, so combine availableModels by id #}
+{# pillar.get replaces lists instead of merging them, so combine availableModels by id and alerts queries by name #}
 {% set default_models = {} %}
 {% for m in SOCDEFAULTS.config.server.client.assistant.availableModels %}
 {%   do default_models.setdefault(m.id, m) %}
@@ -41,6 +41,24 @@
 {% endfor %}
 {% do SOCMERGED.config.server.client.assistant.update({'availableModels': merged_models}) %}
 
+{% set default_queries = {} %}
+{% for q in SOCDEFAULTS.config.server.client.alerts.queries %}
+{%   do default_queries.setdefault(q.name, q) %}
+{% endfor %}
+{% set merged_queries = [] %}
+{% set merged_names = [] %}
+{% for q in SOCMERGED.config.server.client.alerts.queries or [] %}
+{%   set query = {} %}
+{%   do query.update(default_queries.get(q.get('name'), {})) %}
+{%   do query.update(q) %}
+{%   do merged_queries.append(query) %}
+{%   do merged_names.append(q.get('name')) %}
+{% endfor %}
+{% for name, q in default_queries.items() if name not in merged_names %}
+{%   do merged_queries.append(q) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.alerts.update({'queries': merged_queries}) %}
+
 {% if not SOCMERGED.config.server.modules.postgres.host %}
 {%   do SOCMERGED.config.server.modules.postgres.update({'host': GLOBALS.manager}) %}
 {% endif %}