Merge pull request #16333 from Security-Onion-Solutions/cogburn/automation-turn-timeout

Automation Turn Timeout

salt/soc/defaults.yaml

@@ -1571,6 +1571,7 @@ soc:
             tickIntervalSeconds: 60
             maxConcurrentItems: 4
             maxQueuedItems: 0
+            turnTimeoutSeconds: 300
             alertTriageEpoch: "2026-09-24T00:00:00Z"
           tools:
             filterEventFields:

salt/soc/soc_soc.yaml

@@ -1058,6 +1058,12 @@ soc:
               global: True
               advanced: True
               forcedType: int
+            turnTimeoutSeconds:
+              description: Maximum number of seconds a single model turn of an automation's agent session may run, even while the model is still producing output. A turn that exceeds this limit is abandoned and the session is recorded as failed. Set to 0 to disable the timeout. Edit this setting via the Agent Studio.
+              global: True
+              advanced: True
+              forcedType: int
+              readonlyUi: True
             alertTriageEpoch:
               description: The earliest alert time the Alert Triage automation will consider. Alerts before this time are never triaged, which keeps a first run on an existing deployment from working through old history. Must be in UTC format (2026-09-24T00:00:00Z).
               regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'