Corey Ogburn
691bef2cf4
New Configurable Timeouts for Detection Engine Syncs
...
Each engine now has timeouts for how long to allow a sync to go on after detections are modified.
2026-10-28 10:48:03 -06:00
Corey Ogburn
69b2cb2b02
Automation Turn Timeout
...
Simplified to turnTimeoutSeconds as it sits on automationSettings and doesn't need to stutter.
2026-10-15 13:06:09 -06:00
Mike Reeves
da25083837
Change readonly to readonlyUi in YAML configuration
2026-10-15 11:39:59 -04:00
Mike Reeves
cfb8992a92
Add readonly attribute to earliest alert time field
2026-10-15 11:16:48 -04:00
Mike Reeves
26f5d07435
Remove the Notifier agent mapping
...
AlertTriage now sends its own notification through the Notify skill, so the
Notifier agent no longer exists in SOC.
2026-10-13 17:35:22 -04:00
Mike Reeves
747abeed79
Merge pull request #16302 from Security-Onion-Solutions/mreeves/alert-assessment-groupby
...
Add a licensed Group By Assessment, Name alerts query
2026-10-13 17:16:48 -04:00
Josh Brower
7214f8770c
Merge pull request #16269 from Security-Onion-Solutions/esql-correlations
...
Initial Correlations support
2026-10-09 15:53:10 -04:00
Mike Reeves
946e904434
Merge pull request #16301 from Security-Onion-Solutions/mreeves/alert-triage-agent
...
Map the AlertTriage and Notifier agents to a model
2026-10-09 12:39:24 -04:00
Matthew Wright
de63f95ab0
turn off advanced
2026-10-08 12:38:13 -04:00
Matthew Wright
a1b76650fb
add external image markdown toggle
2026-10-08 12:10:30 -04:00
Jason Ertel
2eab084358
new destination timeout annotation; fix fp
2026-10-08 10:46:15 -04:00
defensivedepth
d352bc0384
ES|QL and Sigma correlation support
2026-10-07 11:26:32 -04:00
Mike Reeves
3304aff62b
Note that an oai query also needs the agentic assistant
...
SOC (securityonion-soc#1363) now hides a query licensed for oai unless the
assistant is enabled and agentic, so the query editor's license help says so.
Claude-Session: https://claude.ai/code/session_01SZLcwj68A2wLo3F8TGKsLP
2026-10-07 08:56:44 -04:00
Mike Reeves
7469d833d1
Add a licensed Group By Assessment, Name alerts query
...
Groups alerts by the AI triage assessment, keeping untriaged alerts as a
missing bucket. Query entries take an optional license feature, which SOC uses
to hide this one on grids without OnionAI, and the query editor now shows it.
2026-10-06 21:14:25 -04:00
Mike Reeves
b11fc6257a
Map the AlertTriage and Notifier agents to a model
...
SOC disables a built-in agent that has no agentMapping entry, so the new
AlertTriage agent and the Notifier it delegates to need one to run.
2026-10-06 20:43:04 -04:00
Jason Ertel
f4b301d71c
update tick interval desc
2026-10-06 18:32:49 -04:00
Corey Ogburn
22bda63847
Unified Automations
...
Remove the template and mark automations as advanced, readonly, and stored in the DB.
2026-10-01 09:59:12 -06:00
Corey Ogburn
855716846a
New Automation Fields
2026-09-29 16:50:04 -06:00
Jason Ertel
a8f7c46b0d
Merge branch '3/dev' into jertel/wip
2026-09-28 13:47:19 -04:00
Jason Ertel
26d895ccb7
alarms and ntf
2026-09-28 13:47:16 -04:00
Mike Reeves
efe0581892
Add openai_embeddings to the YAML configuration
2026-09-24 15:27:51 -04:00
Jason Ertel
36652e8f23
fixed malformed desc annotation
2026-09-22 08:30:44 -04:00
Jason Ertel
e2bf2837fe
notification annotations
2026-09-22 08:18:59 -04:00
Jason Ertel
b7a11a525c
store in db
2026-09-18 12:41:35 -04:00
Jason Ertel
ecc643cd33
fix typo
2026-09-17 15:34:29 -04:00
Jason Ertel
08aaf7948e
Merge branch '3/dev' into jertel/wip
2026-09-17 15:32:35 -04:00
Jason Ertel
bb57545d08
new annotations for notifications
2026-09-17 15:32:21 -04:00
Josh Brower
0f7adbbecc
Merge pull request #16247 from Security-Onion-Solutions/esql-fixes
...
Refactor for ESQL
2026-09-17 09:56:19 -04:00
defensivedepth
f3aa39c5a4
Tweak name
2026-09-17 09:43:44 -04:00
defensivedepth
1fc5bb7afa
Refactor for ESQL
2026-09-17 07:56:42 -04:00
Corey Ogburn
1624e8c094
filterEventFields
...
Previously hard coded array of fields is now a config option with the hard coded value as the default value.
2026-09-11 10:54:20 -06:00
Corey Ogburn
67b4d82f62
Improved Description of MemoryExtractBatchSize
2026-09-04 12:49:29 -06:00
Corey Ogburn
30574fdbb9
Batch Size and Retries
...
2 new config fields. Batch size is used to limit how many message turns we put in the transcript when we ask the memory agent to extract facts. The retries helps limit how many times we ask the memory agent to process a problematic session.
2026-09-04 12:18:29 -06:00
Corey Ogburn
ee671e7ec9
Define ToolTurn Defaults
...
When auto approving tools, we might approve a tool_request before it's been saved to ES. These vars describe some leniency in retrying when the message can't be found before giving up.
2026-09-02 11:42:29 -06:00
Corey Ogburn
332a5d11bc
Fix Regex
...
Double quoted stings in yaml allow for escape sequences like `\n` and `\t` but when used around a regex, salt will hang up on `\d` not being a valid escape sequence. Switching to single quotes so escapes aren't processed.
2026-09-02 09:08:46 -06:00
Corey Ogburn
fb7e065590
Remove YYYY-MM-DD
...
No more instances of YYYY-MM-DD
2026-09-01 09:32:26 -06:00
Corey Ogburn
bce6b0c1fe
Allow Timestamp in dontScanBefore
...
Now storing UTC timestamp in the dontScanBefore field.
2026-08-31 16:11:29 -06:00
Corey Ogburn
b9ba7df80c
DontScanBefore
...
New field that'll stop the memory scanner from scanning before an indicated date. Leaving it empty lets the scanner scan everything.
The regex for it allows YYYY-MM-DD and ensures months only allow the max number of days (no June the 43rd).
2026-08-28 19:02:39 -06:00
Matthew Wright
3a3667996c
make personas non-advanced and readonlyui
2026-08-26 15:08:17 -04:00
Matthew Wright
fb7d162de1
memory and reconcile persona annotations
2026-08-26 12:36:46 -04:00
Corey Ogburn
a127ef5714
Show Toggle in UI
...
Must specify bool fields with `forcedType: bool` in order for them to render as toggles in the UI.
2026-08-24 14:09:37 -06:00
Corey Ogburn
99e1d83358
Add Interval and Disable by Default
...
Added `memoryScanIntervalSeconds` with a default of 5 mins.
Opted to set `useMemoryScanner` to false so by default our user's sessions are not sent to the cloud before they have a chance to configure the new setting.
2026-08-24 14:09:36 -06:00
Corey Ogburn
60052e0910
Memory Defaults and Annotations
2026-08-24 14:09:36 -06:00
Matthew Wright
ea502e29d0
agentic salt annotations
2026-08-13 12:09:59 -04:00
Mike Reeves
334978ad92
Rename Detection Engineer agent key to DetectionEngineer
...
The agent name is also the agentMapping config key and a SOC setting id
segment, so the space made it awkward to target. Matches the rename in
securityonion-soc.
2026-07-22 11:55:12 -04:00
Jason Ertel
4e1935f8a0
postgress updates
2026-07-21 11:58:11 -04:00
Josh Brower
48a7d66964
Update baseline agents
2026-07-17 15:20:20 -04:00
coreyogburn
032d792331
Merge pull request #16030 from Security-Onion-Solutions/feature/agentic
...
Feature/agentic
2026-07-07 14:37:52 -06:00
Corey Ogburn
83cf1f0793
New Client Params for Tool Retries
2026-07-02 10:11:52 -06:00
Corey Ogburn
8675296393
More Agentic Fields
...
The big agentic switch, a specific maxDelegationDepth, and the agentMapping dict
2026-07-01 15:04:42 -06:00
Corey Ogburn
Mike Reeves
Josh Brower
Matthew Wright
Jason Ertel
Mike Reeves
coreyogburn