From bdcd1e099d62071b9df433607e925725cb97c085 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 21 Oct 2025 09:33:41 -0400
Subject: [PATCH] add exclusion toggle

---
 salt/soc/defaults.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index d93b405b1..447024e1a 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1636,6 +1636,9 @@ soc:
             - name: socExcludeToggle
               filter: 'NOT event.module:"soc"'
               enabled: true
+            - name: onionaiExcludeToggle
+              filter: 'NOT _index:"*:so-assistant-*"'
+              enabled: true
           queries:
             - name: Default Query
               description: Show all events grouped by the observer host