Map the AlertTriage and Notifier agents to a model

SOC disables a built-in agent that has no agentMapping entry, so the new
AlertTriage agent and the Notifier it delegates to need one to run.

salt/elasticsearch/defaults.yaml

@@ -1,7 +1,7 @@
 elasticsearch:
   enabled: false
   esheap: '600m'
-  version: 9.4.8
+  version: 9.4.5
   index_clean: true
   data_retention_method: DLM
   vm:

salt/kibana/defaults.yaml

@@ -22,7 +22,7 @@ kibana:
           - default
           - file
     migrations:
-      discardCorruptObjects: "9.4.8"
+      discardCorruptObjects: "9.4.5"
     telemetry:
       enabled: False
     xpack:

salt/manager/tools/sbin/soup

@@ -1535,10 +1535,9 @@ verify_es_version_compatibility() {
       ["8.18.4"]="8.18.6 8.18.8 9.0.8"
 	    ["8.18.6"]="8.18.8 9.0.8"
 	    ["8.18.8"]="9.0.8"
-      ["9.0.8"]="9.3.3 9.3.7 9.4.5 9.4.8"
-      ["9.3.3"]="9.3.7 9.4.5 9.4.8"
-      ["9.3.7"]="9.4.5 9.4.8"
-      ["9.4.5"]="9.4.8"
+      ["9.0.8"]="9.3.3 9.3.7 9.4.5"
+      ["9.3.3"]="9.3.7 9.4.5"
+      ["9.3.7"]="9.4.5"
     )
 
     # Elasticsearch MUST upgrade through these versions

salt/soc/defaults.yaml

@@ -1542,6 +1542,8 @@ soc:
             Orchestrator: sonnet@SOAI
             Investigator: gemma@SOAI
             DetectionEngineer: gemma@SOAI
+            AlertTriage: gemma@SOAI
+            Notifier: gemma@SOAI
           useMemory: false
           useMemoryScanner: false
           dontScanBefore: ""

salt/soc/soc_soc.yaml

@@ -937,6 +937,12 @@ soc:
             DetectionEngineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
+            AlertTriage:
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
+              global: True
+            Notifier:
+              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
+              global: True
           useMemory:
             description: Enables the Memory system for OnionAI
             global: True