Mike Reeves and GitHub
12bb16e89c
Add version 3.3.0 to discussion template
2026-07-29 14:22:42 -04:00
Mike Reeves and GitHub
45f1a1b8b1
Bump version from 3.2.0 to 3.3.0
2026-07-29 14:21:50 -04:00
Mike Reeves and GitHub
d3c6fdce7e
Merge pull request #16124 from Security-Onion-Solutions/3.2.0
...
3.2.0
2026-07-29 13:53:18 -04:00
Mike Reeves
c9642489d3
3.2.0
2026-07-29 13:48:13 -04:00
coreyogburn and GitHub
7b080797b4
Merge pull request #16122 from Security-Onion-Solutions/cogburn/gemma-mapping
...
Investigator and Engineer Use Gemma
2026-07-28 11:12:24 -06:00
Corey Ogburn
d94c16eea1
Investigator and Engineer Use Gemma
2026-07-28 10:26:29 -06:00
coreyogburn and GitHub
3e3d409c42
Merge pull request #16121 from Security-Onion-Solutions/cogburn/update-agentmapping-defaults
...
Change defaults
2026-07-28 10:21:49 -06:00
Corey Ogburn
a45ca12076
Change defaults
...
We're no longer using DisplayName as the model identifier. Refactored to use id@adapter.
2026-07-28 10:19:18 -06:00
Mike Reeves and GitHub
2e141a1ad7
Merge pull request #16119 from Security-Onion-Solutions/TOoSmOotH-patch-3
...
Add Gemma configuration to defaults.yaml
2026-07-27 12:18:47 -04:00
Mike Reeves and GitHub
4de8f0208f
Add Gemma configuration to defaults.yaml
2026-07-27 12:15:21 -04:00
Josh Brower and GitHub
4aabf7d638
Merge pull request #16118 from Security-Onion-Solutions/playbooks-airgap
...
Support sigma playbooks for airgap
2026-07-27 16:33:51 +02:00
Josh Brower
812310088e
Support sigma playbooks for airgap
2026-07-27 10:30:50 -04:00
Josh Patterson and GitHub
4e17390cfa
Merge pull request #16117 from Security-Onion-Solutions/saltthangs
...
update vm state applid for pillar_push_map
2026-07-27 10:25:00 -04:00
Josh Patterson
57d629683d
update vm state applid for pillar_push_map
2026-07-27 10:14:10 -04:00
Jorge Reyes and GitHub
3666b5b0de
Merge pull request #16116 from Security-Onion-Solutions/reyesj2-patch-0
...
ignore all TransformTask failures for so_kibana user
2026-07-27 07:41:07 -05:00
reyesj2
7f64f143d7
ignore all TransformTask failures for so_kibana user
2026-07-26 19:25:51 -05:00
Mike Reeves and GitHub
162c66a705
Merge pull request #16115 from Security-Onion-Solutions/reyesj2-patch-0
...
add sslverify=0 to minion repo config. Updates are pulled from the ma…
2026-07-24 19:06:28 -04:00
reyesj2
14d11cc180
add sslverify=0 to minion repo config. Updates are pulled from the manager hosted repo
2026-07-24 16:59:42 -05:00
Josh Brower and GitHub
112fcf7804
Merge pull request #16114 from Security-Onion-Solutions/fix/sigmapipelines
...
Add already_running mapping
2026-07-24 23:40:45 +02:00
Josh Brower
120b426a79
Add already_running mapping
2026-07-24 17:23:00 -04:00
Jorge Reyes and GitHub
72fd754a92
Merge pull request #16113 from Security-Onion-Solutions/reyesj2-pach-1
...
run es-url-updae prior to upgrade
2026-07-24 14:17:17 -05:00
reyesj2
d5fddafa6a
run es-url-updae prior to upgrade
2026-07-24 13:33:48 -05:00
Jorge Reyes and GitHub
0c83d4e1fe
Merge pull request #16112 from Security-Onion-Solutions/revert-16052-reyesj2-patch-2
...
Revert "elastic fleet server persistence"
2026-07-24 13:23:10 -05:00
Jorge Reyes and GitHub
baca444a7e
Revert "elastic fleet server persistence"
2026-07-24 13:18:48 -05:00
Josh Patterson and GitHub
4f5af93b38
Merge pull request #16111 from Security-Onion-Solutions/saltthangs
...
Express the highstate schedule in minutes instead of hours
2026-07-24 12:54:25 -04:00
Josh Patterson
b109ca4e9b
Express the highstate schedule in minutes instead of hours
...
salt.schedule.highstate_interval_hours could not express a sub-hour
cadence, so an operator who disables salt.auto_apply had no way back to
the legacy 15-minute highstate. Rename the setting to
highstate_interval_minutes (default 120, behavior unchanged) and enforce
a 15-minute floor in SOC.
Non-manager splay is now a quarter of the interval clamped to [5, 30]
minutes, so a short interval no longer gets jitter larger than itself; at
the 120-minute default it stays 1800s. The so-salt-minion-check restart
threshold keeps its interval-plus-one-hour grace, now in minute math.
2026-07-24 12:34:35 -04:00
Josh Patterson and GitHub
e5969a12aa
Merge pull request #16109 from Security-Onion-Solutions/fixESHEAP
...
Add default esheap value so nodes highstate without the pillar value
2026-07-24 09:04:58 -04:00
Jorge Reyes and GitHub
4d97b562eb
Merge pull request #16106 from Security-Onion-Solutions/reyesj2-patch-9
...
call highstate in soup with a retry if first fails vs bailing
2026-07-23 15:50:11 -05:00
reyesj2
f2d81cea3f
call highstate in soup with a retry if first fails vs bailing
2026-07-23 15:06:36 -05:00
Josh Patterson
6bd3c414bb
Add default esheap value so nodes highstate without the pillar value
...
Previously salt/vars/elasticsearch.map.jinja read the elasticsearch heap
size via a raw pillar access (INIT.PILLAR.elasticsearch.esheap). If the
esheap key was missing from a minion pillar, building GLOBALS raised
'dict object has no attribute esheap', cascading into every state that
imports GLOBALS (elasticsearch.enabled, logstash.config, telegraf.config,
etc.) and blocking highstate entirely.
Add an esheap default ('600m', matching the es_heapsize() floor) to
elasticsearch/defaults.yaml and fall back to it via dict .get() so a
missing pillar value degrades gracefully. The per-node pillar value still
wins when present.
2026-07-23 15:16:26 -04:00
Josh Brower and GitHub
16f958dac0
Merge pull request #16103 from Security-Onion-Solutions/defend-mapping
...
Map av to both defender and defend
2026-07-23 20:45:53 +02:00
Mike Reeves and GitHub
a57ff5f89e
Merge pull request #16104 from Security-Onion-Solutions/TOoSmOotH-patch-2
...
Remove icsnpp-modbus from defaults.yaml
2026-07-23 14:44:14 -04:00
Mike Reeves and GitHub
e2513daddc
Remove icsnpp-modbus from defaults.yaml
...
Removed 'icsnpp-modbus' from the list of modules.
2026-07-23 14:39:19 -04:00
Josh Brower
01a873b2d9
Map av to both defender and defend
2026-07-23 13:39:19 -04:00
Jorge Reyes and GitHub
19957d9530
Merge pull request #16099 from Security-Onion-Solutions/reyesj2-patch-7
...
template updates
2026-07-22 17:40:25 -05:00
reyesj2
e4c14a9294
add gc.log to log4j2 delete policy
2026-07-22 16:12:24 -05:00
reyesj2
445ae58919
add optional dlm configs
2026-07-22 15:34:12 -05:00
reyesj2
382dee1d06
include global_override data_retention default for addon integrations that don't yet have a default value defined
2026-07-22 12:19:36 -05:00
reyesj2
f4aa9932ff
add default templates for system integration metrics indices
2026-07-22 12:13:45 -05:00
Josh Patterson and GitHub
4871098278
Merge pull request #16097 from Security-Onion-Solutions/saltthangs
...
apply salt.master state instead of just salt.minion during soup
2026-07-22 12:13:59 -04:00
Mike Reeves and GitHub
7b32c73da8
Merge pull request #16096 from Security-Onion-Solutions/rename/detectionengineer-key
...
Rename Detection Engineer agent key to DetectionEngineer
2026-07-22 12:04:17 -04:00
Mike Reeves
334978ad92
Rename Detection Engineer agent key to DetectionEngineer
...
The agent name is also the agentMapping config key and a SOC setting id
segment, so the space made it awkward to target. Matches the rename in
securityonion-soc.
2026-07-22 11:55:12 -04:00
Josh Patterson
a21186ccce
Merge remote-tracking branch 'origin/3/dev' into saltthangs
2026-07-21 16:29:37 -04:00
Josh Patterson
f77fad8087
apply salt.master state instead of just salt.minion
2026-07-21 16:29:24 -04:00
Josh Brower and GitHub
963e475d1a
Merge pull request #16087 from Security-Onion-Solutions/sigma-pipeline
...
Broader support for SigmaHQ rules + Elastic Defend logs
2026-07-21 22:05:19 +02:00
Josh Patterson
ac46636196
ensure salt-master service restarted last
2026-07-21 16:05:18 -04:00
Mike Reeves and GitHub
f3d8bae13d
Merge pull request #16093 from Security-Onion-Solutions/fix/agentic-adapter-resolution
...
Map default agents to model displayName, not id
2026-07-21 15:13:00 -04:00
Mike Reeves
894d323323
Map default agents to model displayName, not id
...
agentMapping values are model displayNames (the canonical selector); the
stock config used the model id, which only resolved via the legacy
id@adapter fallback. Use the Claude Sonnet displayName so agent-to-model
resolution matches the documented contract.
2026-07-21 15:08:24 -04:00
Jason Ertel and GitHub
26eb8c3c18
Merge pull request #16089 from Security-Onion-Solutions/jertel/wip
...
postgress updates
2026-07-21 12:01:41 -04:00
Jason Ertel
4e1935f8a0
postgress updates
2026-07-21 11:58:11 -04:00
Mike ReevesandGitHub
Mike Reeves
coreyogburnandGitHub
Corey Ogburn
Josh BrowerandGitHub
Josh PattersonandGitHub
Jorge ReyesandGitHub
Jason ErtelandGitHub
Jason Ertel