Salt 3006.29 (saltstack/salt#70466) answered the eMudhra/emSign incident by
bumping certifi to 2026.10.19, which drops the "emSign ECC Root CA - G3" root
whose intermediates had recoverable private keys, and by shipping pip 26.2.2,
whose vendored certifi gets the same fix. We stay on 3006.19, so apply the
same two upgrades inside /opt/saltstack/salt from vendored wheels.
relenv is upgraded to 0.22.27 in the same pip invocation. relenv 0.22.2's
runtime wrapper hardcodes pre-26.2 pip install() signatures, so a lone pip
26.2.2 upgrade breaks every later pip run with an unexpected
'script_executable' argument. 0.22.27 is what 3006.29 builds against and its
runtime diff is otherwise cosmetic. Installing all three at once under the
stock pip means no host ever sits in the broken intermediate state.
The state lives in salt.python_modules so new installs get it from
salt_install_module_deps before salt-master starts, and existing grids get it
from the soup highstate plus grid push. It is gated on saltversion 3006.19 so
a future Salt bump disables it, and ordered before the docker module install
so docker is always installed with the fixed pip. The docker wheel set now
carries certifi 2026.10.19 instead of 2024.7.4.
Verified on a fresh 3.4.0 manager + sensor grid: state applies on both,
reruns are no-ops, full highstate passes on both nodes.
pillar.get replaces lists, so once alerts queries are saved to pillar
from the SOC config UI, queries added to defaults later (e.g. the
licensed Group By Assessment, Name) never reach soc.json. Merge them by
name the same way availableModels are merged by id: pillar order and
edits are kept, and default queries missing from pillar are appended.
The assessment is a number, and SOC's missing bucket only works on keyword
fields, so the * made Elasticsearch fail parsing "__missing__" as a long.
Untriaged alerts now drop out of this view.
SOC (securityonion-soc#1363) now hides a query licensed for oai unless the
assistant is enabled and agentic, so the query editor's license help says so.
Claude-Session: https://claude.ai/code/session_01SZLcwj68A2wLo3F8TGKsLP
Groups alerts by the AI triage assessment, keeping untriaged alerts as a
missing bucket. Query entries take an optional license feature, which SOC uses
to hide this one on grids without OnionAI, and the query editor now shows it.
Jason Ertel
Josh Patterson
Jason Ertel
Josh Brower
coreyogburn
Corey Ogburn
Mike Reeves
Jorge Reyes
Matthew Wright
Matthew Wright