CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-09-19 14:19:49 +02:00
Code Issues Packages Projects Releases Wiki Activity
18,719 Commits 39 Branches 130 Tags
8f253d17a6bfebb3ff2d79449e6b57a83a76fc41
Commit Graph
1109 Commits
Author SHA1 Message Date
Corey Ogburn 8f253d17a6 Default Memory to Disabled 
Gives users a chance to reconfigure embed model before messages they send to the OnionAI get sent to SOAI by default.
 2026-09-10 15:18:35 -06:00
Corey Ogburn 67b4d82f62 Improved Description of MemoryExtractBatchSize 2026-09-04 12:49:29 -06:00
Corey Ogburn 30574fdbb9 Batch Size and Retries 
2 new config fields. Batch size is used to limit how many message turns we put in the transcript when we ask the memory agent to extract facts. The retries helps limit how many times we ask the memory agent to process a problematic session.
 2026-09-04 12:18:29 -06:00
Corey Ogburn ee671e7ec9 Define ToolTurn Defaults 
When auto approving tools, we might approve a tool_request before it's been saved to ES. These vars describe some leniency in retrying when the message can't be found before giving up.
 2026-09-02 11:42:29 -06:00
Corey Ogburn 332a5d11bc Fix Regex 
Double quoted stings in yaml allow for escape sequences like `\n` and `\t` but when used around a regex, salt will hang up on `\d` not being a valid escape sequence. Switching to single quotes so escapes aren't processed.
 2026-09-02 09:08:46 -06:00
Corey Ogburn fb7e065590 Remove YYYY-MM-DD 
No more instances of YYYY-MM-DD
 2026-09-01 09:32:26 -06:00
Corey Ogburn bce6b0c1fe Allow Timestamp in dontScanBefore 
Now storing UTC timestamp in the dontScanBefore field.
 2026-08-31 16:11:29 -06:00
Corey Ogburn b9ba7df80c DontScanBefore 
New field that'll stop the memory scanner from scanning before an indicated date. Leaving it empty lets the scanner scan everything.

The regex for it allows YYYY-MM-DD and ensures months only allow the max number of days (no June the 43rd).
 2026-08-28 19:02:39 -06:00
Matthew Wright 3a3667996c make personas non-advanced and readonlyui 2026-08-26 15:08:17 -04:00
Matthew Wright fb7d162de1 memory and reconcile persona annotations 2026-08-26 12:36:46 -04:00
Corey Ogburn a127ef5714 Show Toggle in UI 
Must specify bool fields with `forcedType: bool` in order for them to render as toggles in the UI.
 2026-08-24 14:09:37 -06:00
Corey Ogburn fcb889a30c Specify Default Embed Model 2026-08-24 14:09:37 -06:00
Corey Ogburn 99e1d83358 Add Interval and Disable by Default 
Added `memoryScanIntervalSeconds` with a default of 5 mins.

Opted to set `useMemoryScanner` to false so by default our user's sessions are not sent to the cloud before they have a chance to configure the new setting.
 2026-08-24 14:09:36 -06:00
Corey Ogburn 60052e0910 Memory Defaults and Annotations 2026-08-24 14:09:36 -06:00
Josh Brower 7bdaf9338e Update Sigma template 2026-08-20 09:31:56 -04:00
Matthew Wright ea502e29d0 agentic salt annotations 2026-08-13 12:09:59 -04:00
Jason Ertel a7ddb7a975 Use newer /api/joblookup endpoint 2026-08-10 13:38:41 -04:00
Corey Ogburn d94c16eea1 Investigator and Engineer Use Gemma 2026-07-28 10:26:29 -06:00
Corey Ogburn a45ca12076 Change defaults 
We're no longer using DisplayName as the model identifier. Refactored to use id@adapter.
 2026-07-28 10:19:18 -06:00
Mike Reeves 4de8f0208f Add Gemma configuration to defaults.yaml 2026-07-27 12:15:21 -04:00
Josh Brower 812310088e Support sigma playbooks for airgap 2026-07-27 10:30:50 -04:00
Josh Brower 120b426a79 Add already_running mapping 2026-07-24 17:23:00 -04:00
Josh Brower 01a873b2d9 Map av to both defender and defend 2026-07-23 13:39:19 -04:00
Mike Reeves 334978ad92 Rename Detection Engineer agent key to DetectionEngineer 
The agent name is also the agentMapping config key and a SOC setting id
segment, so the space made it awkward to target. Matches the rename in
securityonion-soc.
 2026-07-22 11:55:12 -04:00
Josh Brower 963e475d1a Merge pull request #16087 from Security-Onion-Solutions/sigma-pipeline 
Broader support for SigmaHQ rules + Elastic Defend logs
 2026-07-21 22:05:19 +02:00
Mike Reeves f3d8bae13d Merge pull request #16093 from Security-Onion-Solutions/fix/agentic-adapter-resolution 
Map default agents to model displayName, not id
 2026-07-21 15:13:00 -04:00
Mike Reeves 894d323323 Map default agents to model displayName, not id 
agentMapping values are model displayNames (the canonical selector); the
stock config used the model id, which only resolved via the legacy
id@adapter fallback. Use the Claude Sonnet displayName so agent-to-model
resolution matches the documented contract.
 2026-07-21 15:08:24 -04:00
Jason Ertel 4e1935f8a0 postgress updates 2026-07-21 11:58:11 -04:00
Josh Brower c4c1464b2a Better support SigmaHQ rules 2026-07-21 10:07:33 -04:00
Josh Patterson c4295b4e0a Merge pull request #16071 from Security-Onion-Solutions/saltthangs 
auto state apply
 2026-07-20 08:56:08 -04:00
Josh Brower 48a7d66964 Update baseline agents 2026-07-17 15:20:20 -04:00
Josh Patterson f958212bea Merge remote-tracking branch 'origin/3/dev' into saltthangs 2026-07-15 15:07:09 -04:00
Jason Ertel 566f90a0c0 toggle pg metrics 2026-07-10 10:32:25 -04:00
coreyogburn 032d792331 Merge pull request #16030 from Security-Onion-Solutions/feature/agentic 
Feature/agentic
 2026-07-07 14:37:52 -06:00
Josh Patterson 66a1141b84 Merge remote-tracking branch 'origin/3/dev' into saltthangs 2026-07-07 09:02:15 -04:00
Josh Brower db91ce981d Add repo names 2026-07-07 07:49:11 -04:00
Josh Brower 9975d36b4f Merge pull request #16019 from Security-Onion-Solutions/feature/sigma-playbooks 
support sigma playbooks
 2026-07-06 13:17:54 +02:00
Josh Brower 1fe7726aff Changes from feedback 2026-07-02 14:58:48 -04:00
Corey Ogburn 83cf1f0793 New Client Params for Tool Retries 2026-07-02 10:11:52 -06:00
Corey Ogburn 8675296393 More Agentic Fields 
The big agentic switch, a specific maxDelegationDepth, and the agentMapping dict
 2026-07-01 15:04:42 -06:00
Matthew Wright 23f04e2866 maxSubSessionTokens and maxDelegationDepth config settings 2026-07-01 15:02:21 -06:00
reyesj2 868b217549 update default hunt query 2026-07-01 11:37:46 -05:00
Josh Brower 2a6cc58306 Simplify mappings 2026-07-01 09:07:02 -04:00
Josh Brower 9217670bab support sigma playbooks 2026-06-30 16:21:01 -04:00
Josh Patterson d71e80cf66 Merge remote-tracking branch 'origin/3/dev' into saltthangs 2026-06-23 10:32:32 -04:00
Jason Ertel ae1ddf3817 es|ql defaults 2026-06-15 12:33:08 -04:00
Josh Patterson 33a116357d Merge remote-tracking branch 'origin/3/dev' into saltthangs 2026-06-10 08:56:17 -04:00
Jason Ertel 61e72c89e4 postgres updates 2026-06-03 09:49:53 -04:00
Jason Ertel 7ca2313255 move to securityonion db 2026-06-03 09:05:23 -04:00
Josh Patterson d48a22e37e Merge pull request #15944 from Security-Onion-Solutions/jertel/wip 
Jertel/wip
 2026-05-28 14:01:42 -04:00