From 48a7d66964e910b6793a36fc27621147d07d80a7 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Fri, 17 Jul 2026 15:20:20 -0400
Subject: [PATCH] Update baseline agents

---
 salt/soc/defaults.yaml | 3 ++-
 salt/soc/soc_soc.yaml  | 7 +++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 8df30736f..9705c1863 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1531,7 +1531,8 @@ soc:
           agentic: false
           agentMapping:
             Orchestrator: sonnet
-            Hunter: sonnet
+            Investigator: sonnet
+            Detection Engineer: sonnet
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 47c7ea3ee..f09317f39 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -783,8 +783,11 @@ soc:
             Orchestrator:
               description: The initial agent in most agentic conversations. This agent will delegate requests to specialized agents.
               global: True
-            Hunter:
-              description: This agent is specialized in querying events.
+            Investigator:
+              description: This agent investigates alerts, explains events and records, and hunts through event data. It can also acknowledge alerts and escalate to cases.
+              global: True
+            Detection Engineer:
+              description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
       client:
         assistant: