CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-09-20 22:54:26 +02:00
Code Issues Packages Projects Releases Wiki Activity
18,720 Commits 39 Branches 130 Tags
37782fb45cc3c815770dfd3b08475cedbc32a5f2
Commit Graph
364 Commits
Author SHA1 Message Date
Corey Ogburn 30574fdbb9 Batch Size and Retries 
2 new config fields. Batch size is used to limit how many message turns we put in the transcript when we ask the memory agent to extract facts. The retries helps limit how many times we ask the memory agent to process a problematic session.
 2026-09-04 12:18:29 -06:00
Corey Ogburn ee671e7ec9 Define ToolTurn Defaults 
When auto approving tools, we might approve a tool_request before it's been saved to ES. These vars describe some leniency in retrying when the message can't be found before giving up.
 2026-09-02 11:42:29 -06:00
Corey Ogburn b9ba7df80c DontScanBefore 
New field that'll stop the memory scanner from scanning before an indicated date. Leaving it empty lets the scanner scan everything.

The regex for it allows YYYY-MM-DD and ensures months only allow the max number of days (no June the 43rd).
 2026-08-28 19:02:39 -06:00
Matthew Wright fb7d162de1 memory and reconcile persona annotations 2026-08-26 12:36:46 -04:00
Corey Ogburn fcb889a30c Specify Default Embed Model 2026-08-24 14:09:37 -06:00
Corey Ogburn 99e1d83358 Add Interval and Disable by Default 
Added `memoryScanIntervalSeconds` with a default of 5 mins.

Opted to set `useMemoryScanner` to false so by default our user's sessions are not sent to the cloud before they have a chance to configure the new setting.
 2026-08-24 14:09:36 -06:00
Corey Ogburn 60052e0910 Memory Defaults and Annotations 2026-08-24 14:09:36 -06:00
Josh Brower 7bdaf9338e Update Sigma template 2026-08-20 09:31:56 -04:00
Jason Ertel a7ddb7a975 Use newer /api/joblookup endpoint 2026-08-10 13:38:41 -04:00
Corey Ogburn d94c16eea1 Investigator and Engineer Use Gemma 2026-07-28 10:26:29 -06:00
Corey Ogburn a45ca12076 Change defaults 
We're no longer using DisplayName as the model identifier. Refactored to use id@adapter.
 2026-07-28 10:19:18 -06:00
Mike Reeves 4de8f0208f Add Gemma configuration to defaults.yaml 2026-07-27 12:15:21 -04:00
Josh Brower 812310088e Support sigma playbooks for airgap 2026-07-27 10:30:50 -04:00
Mike Reeves 334978ad92 Rename Detection Engineer agent key to DetectionEngineer 
The agent name is also the agentMapping config key and a SOC setting id
segment, so the space made it awkward to target. Matches the rename in
securityonion-soc.
 2026-07-22 11:55:12 -04:00
Mike Reeves f3d8bae13d Merge pull request #16093 from Security-Onion-Solutions/fix/agentic-adapter-resolution 
Map default agents to model displayName, not id
 2026-07-21 15:13:00 -04:00
Mike Reeves 894d323323 Map default agents to model displayName, not id 
agentMapping values are model displayNames (the canonical selector); the
stock config used the model id, which only resolved via the legacy
id@adapter fallback. Use the Claude Sonnet displayName so agent-to-model
resolution matches the documented contract.
 2026-07-21 15:08:24 -04:00
Jason Ertel 4e1935f8a0 postgress updates 2026-07-21 11:58:11 -04:00
Josh Brower 48a7d66964 Update baseline agents 2026-07-17 15:20:20 -04:00
coreyogburn 032d792331 Merge pull request #16030 from Security-Onion-Solutions/feature/agentic 
Feature/agentic
 2026-07-07 14:37:52 -06:00
Josh Brower db91ce981d Add repo names 2026-07-07 07:49:11 -04:00
Josh Brower 9975d36b4f Merge pull request #16019 from Security-Onion-Solutions/feature/sigma-playbooks 
support sigma playbooks
 2026-07-06 13:17:54 +02:00
Josh Brower 1fe7726aff Changes from feedback 2026-07-02 14:58:48 -04:00
Corey Ogburn 83cf1f0793 New Client Params for Tool Retries 2026-07-02 10:11:52 -06:00
Corey Ogburn 8675296393 More Agentic Fields 
The big agentic switch, a specific maxDelegationDepth, and the agentMapping dict
 2026-07-01 15:04:42 -06:00
Matthew Wright 23f04e2866 maxSubSessionTokens and maxDelegationDepth config settings 2026-07-01 15:02:21 -06:00
reyesj2 868b217549 update default hunt query 2026-07-01 11:37:46 -05:00
Josh Brower 9217670bab support sigma playbooks 2026-06-30 16:21:01 -04:00
Jason Ertel ae1ddf3817 es|ql defaults 2026-06-15 12:33:08 -04:00
Jason Ertel 61e72c89e4 postgres updates 2026-06-03 09:49:53 -04:00
Jason Ertel 7ca2313255 move to securityonion db 2026-06-03 09:05:23 -04:00
Josh Patterson 93ffce98d7 add onionconfig and postgres modules to soc config 2026-05-27 15:07:25 -04:00
Matthew Wright 28d31f4840 add charsPerTokenEstimate 2026-04-08 15:25:51 -04:00
Josh Brower 9e53bd3f2d update yara template 2026-03-24 15:56:26 -04:00
Josh Brower 165e69cd11 Add support for websockets 2026-03-23 07:52:36 -04:00
Jason Ertel 825f377d2d more doc updates 2026-03-18 13:05:36 -04:00
Jason Ertel 863276e24f Merge pull request #15539 from Security-Onion-Solutions/jertel/wip 
prepare for nextgen docs
 2026-02-27 13:18:47 -05:00
Jason Ertel 9bd5e1897a prepare for nextgen docs 2026-02-27 13:09:55 -05:00
Mike Reeves 479e3e0afa Update display name for Claude Sonnet model 2026-02-24 10:10:49 -05:00
Mike Reeves c52d3269d6 Rename model ID from 'sonnet-4.5' to 'sonnet' 2026-02-24 09:45:46 -05:00
Matthew Wright 3d1a2c12ec add investigated query toggle filter 2026-02-17 13:17:12 -05:00
Mike Reeves 0661c3af1a Remove QWEN 235B model from defaults.yaml 
Removed QWEN 235B model and its associated details from defaults.yaml.
 2026-02-09 11:47:58 -05:00
Jason Ertel 4778bd6680 Merge pull request #15472 from Security-Onion-Solutions/jertel/wip 
default roles
 2026-02-09 09:48:46 -05:00
Jason Ertel 5033462098 default roles 2026-02-09 09:29:07 -05:00
Corey Ogburn eea14b493c Assistant Config Tweaks 2026-02-03 12:24:26 -07:00
Corey Ogburn 6b98c5a10d Fix Adapter Names 
The bedrock adapter was renamed to securityonion_ai_cloud. The available models needed updating to match.
 2026-02-03 12:24:26 -07:00
Corey Ogburn 42060a9112 Organized, Annotated 
Settling on the final shape of the new config values.
 2026-02-03 12:24:25 -07:00
Corey Ogburn cca4bec43f Adapter Field 2026-02-03 12:24:24 -07:00
reyesj2 f2b7ffe0eb align with ECS fieldnames 2026-01-05 14:48:10 -06:00
Mike Reeves 99dc72cece Merge branch '2.4/dev' into TOoSmOotH-patch-3 2025-12-10 17:19:32 -05:00
Mike Reeves dc945dad00 Remove Claude Sonnet 4 model configuration 
Removed configuration for Claude Sonnet 4 model.
 2025-12-09 11:00:53 -05:00