From 7469d833d1af3ee6a21209cd553bcba681290e71 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 6 Oct 2026 21:14:25 -0400 Subject: [PATCH 1/3] Add a licensed Group By Assessment, Name alerts query Groups alerts by the AI triage assessment, keeping untriaged alerts as a missing bucket. Query entries take an optional license feature, which SOC uses to hide this one on grids without OnionAI, and the query editor now shows it. --- salt/soc/defaults.yaml | 3 +++ salt/soc/soc_soc.yaml | 2 ++ 2 files changed, 5 insertions(+) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index cd6b183c4..5be549e9e 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -2524,6 +2524,9 @@ soc: queries: - name: 'Group By Name, Module' query: '* | groupby rule.name event.module* event.severity_label rule.uuid' + - name: 'Group By Assessment, Name' + query: '* | groupby event.so_alerttriage.assessment* rule.name event.severity_label rule.uuid' + license: oai - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name' query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid' - name: 'Group By Source IP, Name' diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index d3e0ef5f1..28654bb8a 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -1209,6 +1209,8 @@ soc: - field: showSubtitle label: Show Query in Dropdown. forcedType: bool + - field: license + label: Only show on grids licensed for this feature, e.g. oai. Leave blank to show everywhere. queryToggleFilters: description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query. global: True From 3304aff62ba67f7c9e167e54e587c612ee343c56 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Wed, 7 Oct 2026 08:56:44 -0400 Subject: [PATCH 2/3] Note that an oai query also needs the agentic assistant SOC (securityonion-soc#1363) now hides a query licensed for oai unless the assistant is enabled and agentic, so the query editor's license help says so. Claude-Session: https://claude.ai/code/session_01SZLcwj68A2wLo3F8TGKsLP --- salt/soc/soc_soc.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 28654bb8a..458f287fd 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -1210,7 +1210,7 @@ soc: label: Show Query in Dropdown. forcedType: bool - field: license - label: Only show on grids licensed for this feature, e.g. oai. Leave blank to show everywhere. + label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere. queryToggleFilters: description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query. global: True From 1bcf80dd10cedd0b678b587fea6b066dccb44292 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 13 Oct 2026 17:11:49 -0400 Subject: [PATCH 3/3] Group by assessment without a missing bucket The assessment is a number, and SOC's missing bucket only works on keyword fields, so the * made Elasticsearch fail parsing "__missing__" as a long. Untriaged alerts now drop out of this view. --- salt/soc/defaults.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 5be549e9e..f0cd8d759 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -2525,7 +2525,7 @@ soc: - name: 'Group By Name, Module' query: '* | groupby rule.name event.module* event.severity_label rule.uuid' - name: 'Group By Assessment, Name' - query: '* | groupby event.so_alerttriage.assessment* rule.name event.severity_label rule.uuid' + query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid' license: oai - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name' query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'