From a45ca1207685827161569328d1c4ce43935be60d Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Tue, 28 Jul 2026 10:19:18 -0600
Subject: [PATCH] Change defaults

We're no longer using DisplayName as the model identifier. Refactored to use id@adapter.
---
 salt/soc/defaults.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 848e6bc73..d7ac5ac9e 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1534,9 +1534,9 @@ soc:
               healthTimeoutSeconds: 5
           agentic: false
           agentMapping:
-            Orchestrator: Claude Sonnet
-            Investigator: Claude Sonnet
-            DetectionEngineer: Claude Sonnet
+            Orchestrator: sonnet@SOAI
+            Investigator: sonnet@SOAI
+            DetectionEngineer: sonnet@SOAI
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false