Merge pull request #16301 from Security-Onion-Solutions/mreeves/alert-triage-agent

Map the AlertTriage and Notifier agents to a model

salt/soc/defaults.yaml

@@ -1542,6 +1542,8 @@ soc:
             Orchestrator: sonnet@SOAI
             Investigator: gemma@SOAI
             DetectionEngineer: gemma@SOAI
+            AlertTriage: gemma@SOAI
+            Notifier: gemma@SOAI
           useMemory: false
           useMemoryScanner: false
           dontScanBefore: ""

salt/soc/soc_soc.yaml

@@ -941,6 +941,12 @@ soc:
             DetectionEngineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
+            AlertTriage:
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
+              global: True
+            Notifier:
+              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
+              global: True
           useMemory:
             description: Enables the Memory system for OnionAI
             global: True