Jason Ertel
a7ddb7a975
Use newer /api/joblookup endpoint
2026-08-10 13:38:41 -04:00
Corey Ogburn
d94c16eea1
Investigator and Engineer Use Gemma
2026-07-28 10:26:29 -06:00
Corey Ogburn
a45ca12076
Change defaults
...
We're no longer using DisplayName as the model identifier. Refactored to use id@adapter.
2026-07-28 10:19:18 -06:00
Mike Reeves
4de8f0208f
Add Gemma configuration to defaults.yaml
2026-07-27 12:15:21 -04:00
Josh Brower
812310088e
Support sigma playbooks for airgap
2026-07-27 10:30:50 -04:00
Mike Reeves
334978ad92
Rename Detection Engineer agent key to DetectionEngineer
...
The agent name is also the agentMapping config key and a SOC setting id
segment, so the space made it awkward to target. Matches the rename in
securityonion-soc.
2026-07-22 11:55:12 -04:00
Mike Reeves
f3d8bae13d
Merge pull request #16093 from Security-Onion-Solutions/fix/agentic-adapter-resolution
...
Map default agents to model displayName, not id
2026-07-21 15:13:00 -04:00
Mike Reeves
894d323323
Map default agents to model displayName, not id
...
agentMapping values are model displayNames (the canonical selector); the
stock config used the model id, which only resolved via the legacy
id@adapter fallback. Use the Claude Sonnet displayName so agent-to-model
resolution matches the documented contract.
2026-07-21 15:08:24 -04:00
Jason Ertel
4e1935f8a0
postgress updates
2026-07-21 11:58:11 -04:00
Josh Brower
48a7d66964
Update baseline agents
2026-07-17 15:20:20 -04:00
coreyogburn
032d792331
Merge pull request #16030 from Security-Onion-Solutions/feature/agentic
...
Feature/agentic
2026-07-07 14:37:52 -06:00
Josh Brower
db91ce981d
Add repo names
2026-07-07 07:49:11 -04:00
Josh Brower
9975d36b4f
Merge pull request #16019 from Security-Onion-Solutions/feature/sigma-playbooks
...
support sigma playbooks
2026-07-06 13:17:54 +02:00
Josh Brower
1fe7726aff
Changes from feedback
2026-07-02 14:58:48 -04:00
Corey Ogburn
83cf1f0793
New Client Params for Tool Retries
2026-07-02 10:11:52 -06:00
Corey Ogburn
8675296393
More Agentic Fields
...
The big agentic switch, a specific maxDelegationDepth, and the agentMapping dict
2026-07-01 15:04:42 -06:00
Matthew Wright
23f04e2866
maxSubSessionTokens and maxDelegationDepth config settings
2026-07-01 15:02:21 -06:00
reyesj2
868b217549
update default hunt query
2026-07-01 11:37:46 -05:00
Josh Brower
9217670bab
support sigma playbooks
2026-06-30 16:21:01 -04:00
Jason Ertel
ae1ddf3817
es|ql defaults
2026-06-15 12:33:08 -04:00
Jason Ertel
61e72c89e4
postgres updates
2026-06-03 09:49:53 -04:00
Jason Ertel
7ca2313255
move to securityonion db
2026-06-03 09:05:23 -04:00
Josh Patterson
93ffce98d7
add onionconfig and postgres modules to soc config
2026-05-27 15:07:25 -04:00
Matthew Wright
28d31f4840
add charsPerTokenEstimate
2026-04-08 15:25:51 -04:00
Josh Brower
9e53bd3f2d
update yara template
2026-03-24 15:56:26 -04:00
Josh Brower
165e69cd11
Add support for websockets
2026-03-23 07:52:36 -04:00
Jason Ertel
825f377d2d
more doc updates
2026-03-18 13:05:36 -04:00
Jason Ertel
863276e24f
Merge pull request #15539 from Security-Onion-Solutions/jertel/wip
...
prepare for nextgen docs
2026-02-27 13:18:47 -05:00
Jason Ertel
9bd5e1897a
prepare for nextgen docs
2026-02-27 13:09:55 -05:00
Mike Reeves
479e3e0afa
Update display name for Claude Sonnet model
2026-02-24 10:10:49 -05:00
Mike Reeves
c52d3269d6
Rename model ID from 'sonnet-4.5' to 'sonnet'
2026-02-24 09:45:46 -05:00
Matthew Wright
3d1a2c12ec
add investigated query toggle filter
2026-02-17 13:17:12 -05:00
Mike Reeves
0661c3af1a
Remove QWEN 235B model from defaults.yaml
...
Removed QWEN 235B model and its associated details from defaults.yaml.
2026-02-09 11:47:58 -05:00
Jason Ertel
4778bd6680
Merge pull request #15472 from Security-Onion-Solutions/jertel/wip
...
default roles
2026-02-09 09:48:46 -05:00
Jason Ertel
5033462098
default roles
2026-02-09 09:29:07 -05:00
Corey Ogburn
eea14b493c
Assistant Config Tweaks
2026-02-03 12:24:26 -07:00
Corey Ogburn
6b98c5a10d
Fix Adapter Names
...
The bedrock adapter was renamed to securityonion_ai_cloud. The available models needed updating to match.
2026-02-03 12:24:26 -07:00
Corey Ogburn
42060a9112
Organized, Annotated
...
Settling on the final shape of the new config values.
2026-02-03 12:24:25 -07:00
Corey Ogburn
cca4bec43f
Adapter Field
2026-02-03 12:24:24 -07:00
reyesj2
f2b7ffe0eb
align with ECS fieldnames
2026-01-05 14:48:10 -06:00
Mike Reeves
99dc72cece
Merge branch '2.4/dev' into TOoSmOotH-patch-3
2025-12-10 17:19:32 -05:00
Mike Reeves
dc945dad00
Remove Claude Sonnet 4 model configuration
...
Removed configuration for Claude Sonnet 4 model.
2025-12-09 11:00:53 -05:00
Mike Reeves
03dd746601
Add origin field to model configurations
2025-12-08 16:34:19 -05:00
Mike Reeves
eec3373ae7
Update display name for Claude Sonnet 4
2025-12-08 16:30:50 -05:00
Mike Reeves
db45ce07ed
Modify model display names and remove GPT-OSS 120B
...
Updated display names for models and removed GPT-OSS 120B.
2025-12-08 16:26:45 -05:00
DefensiveDepth
271f545f4f
Fixup Airgap
2025-12-06 15:26:44 -05:00
DefensiveDepth
4bb0a7c9d9
Merge remote-tracking branch 'origin/2.4/dev' into idstools-refactor
2025-11-25 13:52:21 -05:00
DefensiveDepth
ced3af818c
Refactor for Airgap
2025-11-25 13:51:50 -05:00
DefensiveDepth
148ef7ef21
add default ruleset
2025-11-18 11:57:30 -05:00
reyesj2
45b4b1d963
ingest zeek analyzer.log + update dpd dashboard with analyzer tag
2025-11-14 15:47:29 -06:00
Jason Ertel
Corey Ogburn
Mike Reeves
Josh Brower
Mike Reeves
coreyogburn
Matthew Wright
reyesj2
Josh Patterson
Jason Ertel