From 8f253d17a6bfebb3ff2d79449e6b57a83a76fc41 Mon Sep 17 00:00:00 2001 From: Corey Ogburn Date: Thu, 10 Sep 2026 15:18:35 -0600 Subject: [PATCH 1/7] Default Memory to Disabled Gives users a chance to reconfigure embed model before messages they send to the OnionAI get sent to SOAI by default. --- salt/soc/defaults.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index d14ca3e08..6352ea371 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1537,7 +1537,7 @@ soc: Orchestrator: sonnet@SOAI Investigator: gemma@SOAI DetectionEngineer: gemma@SOAI - useMemory: true + useMemory: false useMemoryScanner: false dontScanBefore: "" memoryScanIntervalSeconds: 300 From 66e78633366d24dea6cde600a1a9b65b58694d59 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 11 Sep 2026 08:56:00 -0400 Subject: [PATCH 2/7] Update HOTFIX version to 3.3.0-20260911 --- HOTFIX | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/HOTFIX b/HOTFIX index 8b1378917..b17d2ca5d 100644 --- a/HOTFIX +++ b/HOTFIX @@ -1 +1 @@ - +3.3.0-20260911 From e4e8b90b9c7b7bf6fe1f5970a8e8c36dfcc71052 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 11 Sep 2026 09:03:24 -0400 Subject: [PATCH 3/7] Update version number in HOTFIX file --- HOTFIX | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/HOTFIX b/HOTFIX index b17d2ca5d..59ed0b69b 100644 --- a/HOTFIX +++ b/HOTFIX @@ -1 +1 @@ -3.3.0-20260911 +20260911 From cb489095789df76370df1d3f12e3eb460ad5abd7 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 11 Sep 2026 10:12:24 -0400 Subject: [PATCH 4/7] Add x86-64-v3 CPU pre-flight check to soup Upstream Elastic now ships binaries built for the x86-64-v3 micro-architecture level. This is not a Security Onion choice: nodes whose CPUs predate x86-64-v3 can no longer run Elastic's own builds, so those nodes break once they are upgraded. Check for support before soup modifies anything, and require the operator to type "override" to proceed when a node is unsupported or offline. Runs after upgrade_check so a grid that is already current exits without prompting. Targets only the roles that run a container built from the so-elastic-agent image, using the role lists already maintained in salt/reactor/pillar_push_map.yaml. Adds --skip-cpu-check to bypass the gate for automation, and exit code 162 when the operator declines to override. --- salt/manager/tools/sbin/soup | 96 +++++++++++++++++++++++++++++++++++- 1 file changed, 95 insertions(+), 1 deletion(-) diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 353158b7e..7ab6d7598 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -120,6 +120,9 @@ check_err() { 161) echo 'Required intermediate Elasticsearch upgrade not complete' ;; + 162) + echo 'One or more Elastic Agent nodes do not support the x86-64-v3 CPU instruction set' + ;; 170) echo "Intermediate upgrade completed successfully to $next_step_so_version, but next soup to Security Onion $originally_requested_so_version could not be started automatically." echo "Start soup again manually to continue the upgrade to Security Onion $originally_requested_so_version." @@ -347,6 +350,83 @@ check_cluster_health() { exit 0 } +no_soup_for_you() { + echo "" + echo "No soup for you!" + exit 162 +} + +check_cpu_compatibility() { + # Roles running a container built from the so-elastic-agent image; mirrors the + # elasticagent and elasticfleet entries in salt/reactor/pillar_push_map.yaml. + local cpu_target='G@role:so-heavynode or G@role:so-eval or G@role:so-fleet or G@role:so-import or G@role:so-manager or G@role:so-managerhype or G@role:so-managersearch or G@role:so-standalone' + local expected_nodes cpu_results node result confirm + local -a unsupported=() offline=() + + echo "Checking that Elastic Agent nodes support the x86-64-v3 CPU instruction set now required by Elastic." + + if [[ "$SKIP_CPU_CHECK" == "true" ]]; then + printf "\nSkipping the x86-64-v3 CPU check because --skip-cpu-check was specified.\n\n" + return + fi + + # Nodes that never answer are absent from the results, so diff against who should have. + expected_nodes=$(salt -C "$cpu_target" --preview-target --out=json 2>/dev/null | jq -r '.[]?') || true + if [[ -z "$expected_nodes" ]]; then + printf "\nCould not determine which nodes run the Elastic Agent, so the x86-64-v3 CPU check cannot run.\n" + no_soup_for_you + fi + + cpu_results=$(salt -t 30 -C "$cpu_target" cmd.run "/lib64/ld-linux-x86-64.so.2 --help | grep x86-64-v3" --out=json 2>/dev/null) || true + + while IFS= read -r node; do + [[ -z "$node" ]] && continue + result=$(jq -r --arg node "$node" '.[$node] // empty' <<< "$cpu_results" 2>/dev/null) + if [[ -z "$result" || "$result" == *"did not return"* ]]; then + offline+=("$node") + elif [[ "$result" != *"x86-64-v3 (supported"* ]]; then + # glibc appends "(supported, searched)" only when supported; the open paren keeps + # this from matching a future "(unsupported". + unsupported+=("$node") + fi + done <<< "$expected_nodes" + + if [[ ${#unsupported[@]} -eq 0 && ${#offline[@]} -eq 0 ]]; then + printf "\nAll Elastic Agent nodes support x86-64-v3. We can proceed with SOUP.\n\n" + return + fi + + echo "" + if [[ ${#unsupported[@]} -gt 0 ]]; then + echo "The following node(s) do NOT support the x86-64-v3 CPU instruction set:" + printf ' %s\n' "${unsupported[@]}" + echo "" + echo "Upstream Elastic now builds its binaries for x86-64-v3, so these nodes can no" + echo "longer run Elastic. Upgrading them WILL BREAK them." + echo "" + fi + if [[ ${#offline[@]} -gt 0 ]]; then + echo "The following node(s) did not respond and could not be checked:" + printf ' %s\n' "${offline[@]}" + echo "" + echo "These nodes are offline, so we cannot confirm they support x86-64-v3, which" + echo "upstream Elastic now requires." + echo "" + fi + + if [[ -n $UNATTENDED ]]; then + echo "Unattended mode cannot prompt for an override. Re-run soup interactively, or pass --skip-cpu-check to bypass this check." + no_soup_for_you + fi + + read -rp "Type 'override' to continue anyway, or press Enter to exit: " confirm + if [[ "${confirm,,}" == "override" ]]; then + printf "\nOverride accepted. Continuing at your own risk.\n\n" + else + no_soup_for_you + fi +} + check_fleet_server() { echo "Checking that Elastic Fleet Server is responding." # Modeled on the wait_for_so-elastic-fleet state check in elasticfleet/enabled.sls, @@ -1977,6 +2057,9 @@ main() { echo "Let's see if we need to update Security Onion." upgrade_check + + check_cpu_compatibility + upgrade_space echo "Verifying Elasticsearch version compatibility across the grid before upgrading." @@ -2255,6 +2338,17 @@ fi echo "### soup has been served at $(date) ###" } +SKIP_CPU_CHECK=false +declare -a SOUP_ARGS=() +for arg in "$@"; do + if [[ "$arg" == "--skip-cpu-check" ]]; then + SKIP_CPU_CHECK=true + else + SOUP_ARGS+=("$arg") + fi +done +set -- "${SOUP_ARGS[@]}" + while getopts ":b:f:y" opt; do case ${opt} in b ) @@ -2278,7 +2372,7 @@ while getopts ":b:f:y" opt; do ISOLOC="$OPTARG" ;; \? ) - echo "Usage: soup [-b] [-y] [-f ]" + echo "Usage: soup [-b] [-y] [-f ] [--skip-cpu-check]" exit 1 ;; : ) From bee03d5baedc127868f38fee1f7319d8d9c996e1 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 11 Sep 2026 16:13:09 -0400 Subject: [PATCH 5/7] 3.3.0 hotfix --- DOWNLOAD_AND_VERIFY_ISO.md | 22 +++++++++++----------- sigs/securityonion-3.3.0-20260911.iso.sig | Bin 0 -> 566 bytes 2 files changed, 11 insertions(+), 11 deletions(-) create mode 100644 sigs/securityonion-3.3.0-20260911.iso.sig diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md index 284b89ae3..11aff3ebb 100644 --- a/DOWNLOAD_AND_VERIFY_ISO.md +++ b/DOWNLOAD_AND_VERIFY_ISO.md @@ -1,17 +1,17 @@ -### 3.3.0-20260908 ISO image released on 2026/09/08 +### 3.3.0-20260911ISO image released on 2026/09/11 ### Download and Verify -3.3.0-20260908 ISO image: -https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260908.iso +3.3.0-20260911ISO image: +https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso -MD5: 5A2C42D0083F2D7B4DC2178C30EBC05F -SHA1: 505220A8A3315AFEE601C13772996018425CCD29 -SHA256: 6EB8401296A1D051FEC558C520D2D4AB1912A72D351A2426FBF8C87FEE2BA844 +MD5: 12B18433D3A2198A185892FF79CF638F +SHA1: 2B3C2E1FA7A78ED1F956E7EDCC12E32593C14EEE +SHA256: 0938C73B76CE30EC9E4394D312C79EA7CAC721B6818541697279A6221F7D870D Signature for ISO image: -https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260908.iso.sig +https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig Signing key: https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS @@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/ Download the signature file for the ISO: ``` -wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260908.iso.sig +wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig ``` Download the ISO image: ``` -wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260908.iso +wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso ``` Verify the downloaded ISO image using the signature file: ``` -gpg --verify securityonion-3.3.0-20260908.iso.sig securityonion-3.3.0-20260908.iso +gpg --verify securityonion-3.3.0-20260911.iso.sig securityonion-3.3.0-20260911.iso ``` The output should show "Good signature" and the Primary key fingerprint should match what's shown below: ``` -gpg: Signature made Tue 08 Sep 2026 10:07:12 AM EDT using RSA key ID FE507013 +gpg: Signature made Fri 11 Sep 2026 11:23:56 AM EDT using RSA key ID FE507013 gpg: Good signature from "Security Onion Solutions, LLC " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. diff --git a/sigs/securityonion-3.3.0-20260911.iso.sig b/sigs/securityonion-3.3.0-20260911.iso.sig new file mode 100644 index 0000000000000000000000000000000000000000..3f90eed8b3f48ff85ab9b9da243b7831ea3ec98b GIT binary patch literal 566 zcmV-60?GY}0y6{v0SEvc79j-41gSkXz6^6dp_W8^5Ma0dP;e6k0&1ik3;+rV5PT3| zxBgIY6S@l!0G8Xbjr@wW&r0HdFoxB~)^;I_h>)VMDjG#yN4MES%e{%h3y^xv++}G< z>v39FTb=Mf`)-m2ndknBBSI`rTSpYvK%$)1OgU;P!v|A`s|>{?x!S_y{#OWm{~*U~ zo1=<8-n3zc7(nei5V-&^32DCg~w2f0iO1n8wWvf;t| z9r~+bctW#nlFMl7;-x6W-c?4wLu0!Dh~K_KCwxxJCB5m1!U7u!QKKmrSyFlE3qs~( z{w5-rYJ8 Date: Fri, 11 Sep 2026 16:16:01 -0400 Subject: [PATCH 6/7] 3.3.0 hotfix --- DOWNLOAD_AND_VERIFY_ISO.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md index 11aff3ebb..a9732437e 100644 --- a/DOWNLOAD_AND_VERIFY_ISO.md +++ b/DOWNLOAD_AND_VERIFY_ISO.md @@ -3,7 +3,7 @@ ### Download and Verify -3.3.0-20260911ISO image: +3.3.0-20260911 ISO image: https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso MD5: 12B18433D3A2198A185892FF79CF638F From 7245843a3c0323fe61c97f11c1adbcde1b2b0258 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 11 Sep 2026 16:17:34 -0400 Subject: [PATCH 7/7] 3.3.0 hotfix --- DOWNLOAD_AND_VERIFY_ISO.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md index a9732437e..68ae7f2c4 100644 --- a/DOWNLOAD_AND_VERIFY_ISO.md +++ b/DOWNLOAD_AND_VERIFY_ISO.md @@ -1,4 +1,4 @@ -### 3.3.0-20260911ISO image released on 2026/09/11 +### 3.3.0-20260911 ISO image released on 2026/09/11 ### Download and Verify