defensivedepth
d2251d0cbc
Refactor correlation template
2026-10-19 12:55:51 -04:00
Corey Ogburn
69b2cb2b02
Automation Turn Timeout
...
Simplified to turnTimeoutSeconds as it sits on automationSettings and doesn't need to stutter.
2026-10-15 13:06:09 -06:00
Mike Reeves
da25083837
Change readonly to readonlyUi in YAML configuration
2026-10-15 11:39:59 -04:00
Mike Reeves
cfb8992a92
Add readonly attribute to earliest alert time field
2026-10-15 11:16:48 -04:00
Josh Patterson
ff2b46b73e
combine default and alerts queries added via pillar
...
pillar.get replaces lists, so once alerts queries are saved to pillar
from the SOC config UI, queries added to defaults later (e.g. the
licensed Group By Assessment, Name) never reach soc.json. Merge them by
name the same way availableModels are merged by id: pillar order and
edits are kept, and default queries missing from pillar are appended.
2026-10-14 09:19:16 -04:00
Mike Reeves
26f5d07435
Remove the Notifier agent mapping
...
AlertTriage now sends its own notification through the Notify skill, so the
Notifier agent no longer exists in SOC.
2026-10-13 17:35:22 -04:00
Mike Reeves
747abeed79
Merge pull request #16302 from Security-Onion-Solutions/mreeves/alert-assessment-groupby
...
Add a licensed Group By Assessment, Name alerts query
2026-10-13 17:16:48 -04:00
Mike Reeves
1bcf80dd10
Group by assessment without a missing bucket
...
The assessment is a number, and SOC's missing bucket only works on keyword
fields, so the * made Elasticsearch fail parsing "__missing__" as a long.
Untriaged alerts now drop out of this view.
2026-10-13 17:11:49 -04:00
Josh Patterson
2b6566d33b
combine default and availableModels added via pillar
2026-10-13 13:52:30 -04:00
Josh Brower
7214f8770c
Merge pull request #16269 from Security-Onion-Solutions/esql-correlations
...
Initial Correlations support
2026-10-09 15:53:10 -04:00
Mike Reeves
5d88755429
Increase contextLimitSmall to 1000000
2026-10-09 13:14:26 -04:00
Mike Reeves
ecc75ef65a
Merge branch '3/dev' into mreeves/soai-haiku
2026-10-09 13:13:45 -04:00
Mike Reeves
037f6d3d4f
Update agent mapping for Investigator and DetectionEngineer
2026-10-09 13:09:09 -04:00
Mike Reeves
0cc7e36af5
Reduce contextLimitSmall from 1000000 to 100000
2026-10-09 12:47:46 -04:00
Mike Reeves
946e904434
Merge pull request #16301 from Security-Onion-Solutions/mreeves/alert-triage-agent
...
Map the AlertTriage and Notifier agents to a model
2026-10-09 12:39:24 -04:00
Mike Reeves
b17b596a64
Add Claude Haiku to the SOAI assistant models
2026-10-09 10:11:25 -04:00
defensivedepth
fed0c5739d
Refactor correlations
2026-10-08 19:31:29 -04:00
Matthew Wright
de63f95ab0
turn off advanced
2026-10-08 12:38:13 -04:00
Matthew Wright
a1b76650fb
add external image markdown toggle
2026-10-08 12:10:30 -04:00
Jason Ertel
2eab084358
new destination timeout annotation; fix fp
2026-10-08 10:46:15 -04:00
defensivedepth
d352bc0384
ES|QL and Sigma correlation support
2026-10-07 11:26:32 -04:00
Mike Reeves
3304aff62b
Note that an oai query also needs the agentic assistant
...
SOC (securityonion-soc#1363) now hides a query licensed for oai unless the
assistant is enabled and agentic, so the query editor's license help says so.
Claude-Session: https://claude.ai/code/session_01SZLcwj68A2wLo3F8TGKsLP
2026-10-07 08:56:44 -04:00
Mike Reeves
7469d833d1
Add a licensed Group By Assessment, Name alerts query
...
Groups alerts by the AI triage assessment, keeping untriaged alerts as a
missing bucket. Query entries take an optional license feature, which SOC uses
to hide this one on grids without OnionAI, and the query editor now shows it.
2026-10-06 21:14:25 -04:00
Mike Reeves
b11fc6257a
Map the AlertTriage and Notifier agents to a model
...
SOC disables a built-in agent that has no agentMapping entry, so the new
AlertTriage agent and the Notifier it delegates to need one to run.
2026-10-06 20:43:04 -04:00
Jason Ertel
f4b301d71c
update tick interval desc
2026-10-06 18:32:49 -04:00
defensivedepth
90b3d37be6
Clarify req
2026-10-05 08:14:13 -04:00
defensivedepth
fcd2f67076
Merge remote-tracking branch 'origin/3/dev' into sigma-pipeline-dir
2026-10-05 07:44:53 -04:00
defensivedepth
a9cdd17694
Refactor sigma pipelines
2026-10-02 14:23:57 -04:00
Josh Brower
1aee3f28dc
Merge pull request #16279 from Security-Onion-Solutions/process-caseless-mappings
...
caseless for non-Defend sources
2026-10-02 13:30:45 -04:00
defensivedepth
99322cf26a
Add additional mapping
2026-10-01 15:24:52 -04:00
Corey Ogburn
22bda63847
Unified Automations
...
Remove the template and mark automations as advanced, readonly, and stored in the DB.
2026-10-01 09:59:12 -06:00
defensivedepth
2a4611df45
Add caseless mappings
2026-10-01 10:48:55 -04:00
Corey Ogburn
855716846a
New Automation Fields
2026-09-29 16:50:04 -06:00
Mike Reeves
8e35d70595
Merge pull request #16266 from Security-Onion-Solutions/mreeves/soai-context-1m
...
Raise SOAI Sonnet default small context limit to 1M
2026-09-29 12:19:20 -04:00
Jason Ertel
eb803dce0e
resolve startup errors
2026-09-29 12:02:48 -04:00
Mike Reeves
a06f08217a
Raise SOAI Sonnet default small context limit to 1M
...
Context is now flat-priced, so match contextLimitSmall to contextLimitLarge.
With equal limits the SOC assistant hides the increase-context toggle.
2026-09-29 11:42:29 -04:00
Jason Ertel
a8f7c46b0d
Merge branch '3/dev' into jertel/wip
2026-09-28 13:47:19 -04:00
Jason Ertel
26d895ccb7
alarms and ntf
2026-09-28 13:47:16 -04:00
Mike Reeves
efe0581892
Add openai_embeddings to the YAML configuration
2026-09-24 15:27:51 -04:00
Jason Ertel
36652e8f23
fixed malformed desc annotation
2026-09-22 08:30:44 -04:00
Jason Ertel
e2bf2837fe
notification annotations
2026-09-22 08:18:59 -04:00
Jason Ertel
2e2f62f265
Merge pull request #16252 from Security-Onion-Solutions/jertel/wip
...
store in db
2026-09-18 12:47:32 -04:00
Jason Ertel
b7a11a525c
store in db
2026-09-18 12:41:35 -04:00
Mike Reeves
8eef95ea3e
Merge pull request #16221 from Security-Onion-Solutions/mreeves/kratos-soauth-network
...
Isolate the Kratos admin API on a dedicated soauth docker network
2026-09-18 10:24:00 -04:00
Jason Ertel
ecc643cd33
fix typo
2026-09-17 15:34:29 -04:00
Jason Ertel
08aaf7948e
Merge branch '3/dev' into jertel/wip
2026-09-17 15:32:35 -04:00
Jason Ertel
bb57545d08
new annotations for notifications
2026-09-17 15:32:21 -04:00
Josh Brower
0f7adbbecc
Merge pull request #16247 from Security-Onion-Solutions/esql-fixes
...
Refactor for ESQL
2026-09-17 09:56:19 -04:00
defensivedepth
f3aa39c5a4
Tweak name
2026-09-17 09:43:44 -04:00
defensivedepth
1fc5bb7afa
Refactor for ESQL
2026-09-17 07:56:42 -04:00
defensivedepth
Corey Ogburn
Mike Reeves
Josh Patterson
Matthew Wright
Jason Ertel
Jason Ertel