From d94c16eea1537ec523cd46f0170d6a870969f6bc Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Tue, 28 Jul 2026 10:26:29 -0600
Subject: [PATCH] Investigator and Engineer Use Gemma

---
 salt/soc/defaults.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index d7ac5ac9e..75fc1a597 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1535,8 +1535,8 @@ soc:
           agentic: false
           agentMapping:
             Orchestrator: sonnet@SOAI
-            Investigator: sonnet@SOAI
-            DetectionEngineer: sonnet@SOAI
+            Investigator: gemma@SOAI
+            DetectionEngineer: gemma@SOAI
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false