From 0ebd8e4d6c9d991e772342144e9f601a1717f334 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Wed, 18 Feb 2026 19:00:35 -0600
Subject: [PATCH 1/3] migrate elasticsearch:managed_integrations pillar to new
 manager:managed_integrations pillar

---
 salt/elasticsearch/soc_elasticsearch.yaml |  7 -------
 salt/manager/managed_soc_annotations.sls  |  2 +-
 salt/manager/soc_manager.yaml             |  7 +++++++
 salt/manager/tools/sbin/soup              | 12 ++++++++++++
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml
index 2962d7d37..674c7a569 100644
--- a/salt/elasticsearch/soc_elasticsearch.yaml
+++ b/salt/elasticsearch/soc_elasticsearch.yaml
@@ -84,13 +84,6 @@ elasticsearch:
     custom008: *pipelines
     custom009: *pipelines
     custom010: *pipelines
-  managed_integrations:
-    description: List of integrations to add into SOC config UI. Enter the full or partial integration name. Eg. 1password, 1pass
-    forcedType: "[]string"
-    multiline: True
-    global: True
-    advanced: True
-    helpLink: elasticsearch.html
   index_settings:
     global_overrides:
       index_template:
diff --git a/salt/manager/managed_soc_annotations.sls b/salt/manager/managed_soc_annotations.sls
index 4357b53a2..b2fbb7334 100644
--- a/salt/manager/managed_soc_annotations.sls
+++ b/salt/manager/managed_soc_annotations.sls
@@ -4,7 +4,7 @@
 # Elastic License 2.0.
 
 {# Managed elasticsearch/soc_elasticsearch.yaml file for adding integration configuration items to UI #}
-{% set managed_integrations = salt['pillar.get']('elasticsearch:managed_integrations', []) %}
+{% set managed_integrations = salt['pillar.get']('manager:managed_integrations', []) %}
 {% if managed_integrations and salt['file.file_exists']('/opt/so/state/esfleet_package_components.json') and salt['file.file_exists']('/opt/so/state/esfleet_component_templates.json') %}
 {%   from 'elasticfleet/integration-defaults.map.jinja' import ADDON_INTEGRATION_DEFAULTS %}
 {%   set addon_integration_keys = ADDON_INTEGRATION_DEFAULTS.keys() %}
diff --git a/salt/manager/soc_manager.yaml b/salt/manager/soc_manager.yaml
index f0d699f58..af66d62d8 100644
--- a/salt/manager/soc_manager.yaml
+++ b/salt/manager/soc_manager.yaml
@@ -78,3 +78,10 @@ manager:
         advanced: True
         helpLink: elastic-fleet.html
         forcedType: int
+  managed_integrations:
+    description: List of integrations to add into SOC config UI. Enter the full or partial integration name. Eg. 1password, 1pass
+    forcedType: "[]string"
+    multiline: True
+    global: True
+    advanced: True
+    helpLink: elasticsearch.html
\ No newline at end of file
diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 9d411c5b0..5486d4f72 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -697,6 +697,18 @@ post_to_2.4.210() {
   echo "Regenerating Elastic Agent Installers"
   /sbin/so-elastic-agent-gen-installers
 
+  # migrate elasticsearch:managed_integrations pillar to manager:managed_integrations
+  if managed_integrations=$(/usr/sbin/so-yaml.py get /opt/so/saltstack/local/pillar/elasticsearch/soc_elasticsearch.sls elasticsearch.managed_integrations); then
+    local managed_integrations_old_pillar="/tmp/elasticsearch-managed_integrations.yaml"
+
+    echo "Migrating managed_integrations pillar"
+    echo -e "$managed_integrations" > "$managed_integrations_old_pillar"
+
+    /usr/sbin/so-yaml.py add /opt/so/saltstack/local/pillar/manager/soc_manager.sls manager.managed_integrations file:$managed_integrations > /dev/null 2>&1
+
+  fi
+
+
   POSTVERSION=2.4.210
 }
 

From aa2a1a3d3ca76f718c85f5697023b602d5725094 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Thu, 19 Feb 2026 11:08:06 -0600
Subject: [PATCH 2/3] typo for so-yaml file input

---
 salt/manager/tools/sbin/soup | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 5486d4f72..8d1131803 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -704,7 +704,7 @@ post_to_2.4.210() {
     echo "Migrating managed_integrations pillar"
     echo -e "$managed_integrations" > "$managed_integrations_old_pillar"
 
-    /usr/sbin/so-yaml.py add /opt/so/saltstack/local/pillar/manager/soc_manager.sls manager.managed_integrations file:$managed_integrations > /dev/null 2>&1
+    /usr/sbin/so-yaml.py add /opt/so/saltstack/local/pillar/manager/soc_manager.sls manager.managed_integrations file:$managed_integrations_old_pillar > /dev/null 2>&1
 
   fi
 

From 256c1122c371f74379f3d3c4f677263ead18abe3 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Thu, 19 Feb 2026 11:08:23 -0600
Subject: [PATCH 3/3] remove old pillar

---
 salt/manager/tools/sbin/soup | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 8d1131803..7e42a305d 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -706,6 +706,7 @@ post_to_2.4.210() {
 
     /usr/sbin/so-yaml.py add /opt/so/saltstack/local/pillar/manager/soc_manager.sls manager.managed_integrations file:$managed_integrations_old_pillar > /dev/null 2>&1
 
+    /usr/sbin/so-yaml.py remove /opt/so/saltstack/local/pillar/elasticsearch/soc_elasticsearch.sls elasticsearch.managed_integrations
   fi