agentic salt annotations

salt/common/tools/sbin/so-log-check

@@ -154,8 +154,6 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|id.orig_h"                    # false positive (zeek test data)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|emerging-all.rules"           # false positive (error in rulename)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|invalid query input"          # false positive (Invalid user input in hunt query)
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no data available for the requested dates" # false positive (pcap cypress test submits a job with an empty time frame)
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no job processor"             # false positive (same empty-time-frame job on import nodes, where no pcap processor runs)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|example"                      # false positive (example test data)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|status 200"                   # false positive (request successful, contained error string in content)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|app_layer.error"              # false positive (suricata 7) in stats.log e.g. app_layer.error.imap.parser | Total | 0

salt/soc/soc_soc.yaml

@@ -732,11 +732,13 @@ soc:
             global: True
             advanced: True
             forcedType: int
+            readonlyUi: True
           maxDelegationDepth:
             description: Maximum delegation nesting depth for sub-agents. For example, a value of 2 lets the main agent delegate to a sub-agent that may itself delegate one level deeper. Any deeper delegation is refused and the requesting agent continues without it. Set to 0 to disable the limit.
             global: True
             advanced: True
             forcedType: int
+            readonlyUi: True
           adapters:
             description: Configuration for AI adapters used by the Onion AI assistant. Please see documentation for help on which fields are required for which protocols.
             global: True
@@ -779,6 +781,60 @@ soc:
             description: Indicates if the Assistant Module should operate in agentic mode or not. If true, agents can work together to solve tasks.
             global: True
             forcedType: bool
+          agents:
+            description: Agent definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system agent overrides only the fields an admin may change; everything else comes from the built-in definition.
+            global: True
+            advanced: False
+            readonlyUi: True
+            storage: db
+            forcedType: "[]{}"
+            helpLink: onion-ai
+            syntax: json
+            uiElements:
+            - field: name
+              label: Name
+              required: True
+            - field: enabled
+              label: Enabled
+              forcedType: bool
+            - field: isOrchestrator
+              label: Orchestrator
+              forcedType: bool
+            - field: model
+              label: Model
+            - field: allowedSkills
+              label: Skills
+              forcedType: "[]string"
+            - field: canDelegateTo
+              label: Delegates To
+              forcedType: "[]string"
+            - field: description
+              label: Description
+            - field: persona
+              label: Persona
+              multiline: True
+          skills:
+            description: Skill definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system skill overrides only its enabled state and persona addendum; its tool set comes from the built-in definition.
+            global: True
+            advanced: False
+            readonlyUi: True
+            storage: db
+            forcedType: "[]{}"
+            helpLink: onion-ai
+            syntax: json
+            uiElements:
+            - field: name
+              label: Name
+              required: True
+            - field: enabled
+              label: Enabled
+              forcedType: bool
+            - field: tools
+              label: Tools
+              forcedType: "[]string"
+            - field: persona
+              label: Persona
+              multiline: True
           agentMapping:
             Orchestrator:
               description: The initial agent in most agentic conversations. This agent will delegate requests to specialized agents.

salt/zeek/defaults.yaml

@@ -15,7 +15,7 @@ zeek:
       MailHostUpDown: 0
       LogRotationInterval: 3600
       LogExpireInterval: 0
-      StatsLogEnable: 0
+      StatsLogEnable: 1
       StatsLogExpireInterval: 0
       StatusCmdShowAll: 0
       CrashExpireInterval: 0

salt/zeek/disabled.sls

@@ -23,11 +23,6 @@ zeekpacketlosscron:
     - identifier: zeekpacketlosscron
     - user: root
 
-zeekctlcron:
-  cron.absent:
-    - identifier: zeekctlcron
-    - user: root
-
 {% else %}
 
 {{sls}}_state_not_allowed:

salt/zeek/enabled.sls

@@ -87,21 +87,6 @@ zeekpacketlosscron:
     - month: '*'
     - dayweek: '*'
 
-# LogExpireInterval, StatsLogExpireInterval and CrashExpireInterval are only acted on by
-# 'zeekctl cron', so run it on the interval upstream recommends. This also restarts any
-# node that died unexpectedly. Runs as root because the script needs the docker socket;
-# it drops to the zeek user inside the container.
-zeekctlcron:
-  cron.present:
-    - name: /usr/sbin/so-zeek-cron > /dev/null 2>&1
-    - identifier: zeekctlcron
-    - user: root
-    - minute: '*/5'
-    - hour: '*'
-    - daymonth: '*'
-    - month: '*'
-    - dayweek: '*'
-
 {% else %}
 
 {{sls}}_state_not_allowed:

salt/zeek/soc_zeek.yaml

@@ -58,86 +58,6 @@ zeek:
       CompressLogs:
         description: This setting enables compression of Zeek logs. If you are seeing packet loss at the top of the hour in Zeek or PCAP you might need to disable this by seting it to 0. This will use more disk space but save IO and CPU.
         helpLink: zeek
-      LogExpireInterval:
-        description: >-
-          How long to keep rotated Zeek logs in /nsm/zeek/logs. A bare number means DAYS, so 7 means 7 days.
-          You may also give an explicit unit, such as "7 days" or "12 hr". Use 0 to keep logs forever.
-          This value must not be shorter than LogRotationInterval (3600 seconds by default), so the smallest
-          usable value is 1 hr - Zeek will fail to start if it is shorter. Expiry is applied by "zeekctl cron",
-          which runs every 5 minutes, and removes log files older than this based on their modification time.
-        regex: ^(0|[1-9][0-9]*( ?(day|hr)s?)?)$
-        regexFailureMessage: Enter 0, or a positive number optionally followed by "day" or "hr" (for example 7, "7 days", or "12 hr"). Minutes are not accepted because a log expire interval shorter than the log rotation interval prevents Zeek from starting.
-        helpLink: zeek
-        advanced: True
-      StatsLogEnable:
-        description: >-
-          Set to 1 to have "zeekctl cron" write node statistics to /nsm/zeek/logs/stats. This is
-          disabled because the CPU and memory portion depends on the "top" command, which the Zeek
-          container does not include, so every run records an error for each node instead. The
-          interface packet counters it also collects are not used anywhere in Security Onion, which
-          tracks Zeek packet loss separately through packetloss.log and Telegraf. It is read only
-          for that reason.
-        regex: ^[01]$
-        regexFailureMessage: You must enter 0 or 1.
-        helpLink: zeek
-        advanced: True
-        readonly: True
-      StatsLogExpireInterval:
-        description: >-
-          Number of days to keep entries in the Zeek stats log, or 0 to keep them forever.
-          Applied by "zeekctl cron", which runs every 5 minutes. This has no effect unless
-          StatsLogEnable is turned on, which it is not by default.
-        regex: ^[0-9]+$
-        regexFailureMessage: You must enter a whole number of days, or 0 to keep entries forever.
-        helpLink: zeek
-        advanced: True
-      CrashExpireInterval:
-        description: >-
-          Number of days to keep Zeek crash directories, or 0 to keep them forever.
-          Applied by "zeekctl cron", which runs every 5 minutes.
-        regex: ^[0-9]+$
-        regexFailureMessage: You must enter a whole number of days, or 0 to keep crash directories forever.
-        helpLink: zeek
-        advanced: True
-      MinDiskSpace:
-        description: >-
-          Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check
-          entirely. The Zeek container does not include a mail program, so the warning is not emailed - it
-          appears in the output of "zeekctl cron" instead. This setting never deletes anything - cleanup based
-          on disk usage is handled separately by so-sensor-clean.
-        regex: ^([0-9]|[1-9][0-9]|100)$
-        regexFailureMessage: You must enter a percentage between 0 and 100.
-        helpLink: zeek
-        advanced: True
-      MailTo:
-        description: >-
-          Address that ZeekControl would send mail to, covering cron output and crash reports, and the address
-          Zeek's notice framework would use. The Zeek container does not include a mail program, and Security
-          Onion never enables the notice email action, so no mail is sent and this address is unused. It is
-          read only for that reason.
-        helpLink: zeek
-        advanced: True
-        readonly: True
-      MailConnectionSummary:
-        description: >-
-          Set to 1 to email the hourly connection summary. This only controls the emailed copy - the summary is
-          generated and archived with the other Zeek logs either way. The Zeek container does not include a mail
-          program, so no mail is sent and this setting has no effect. It is read only for that reason.
-        regex: ^[01]$
-        regexFailureMessage: You must enter 0 or 1.
-        helpLink: zeek
-        advanced: True
-        readonly: True
-      MailHostUpDown:
-        description: >-
-          Set to 1 to report when a Zeek node changes between the up and down states. The Zeek container does
-          not include a mail program, so this notification cannot be emailed. It is read only for that reason.
-          Host status detection still runs regardless of this setting - only the notification is affected.
-        regex: ^[01]$
-        regexFailureMessage: You must enter 0 or 1.
-        helpLink: zeek
-        advanced: True
-        readonly: True
   policy:
     custom:
       filters: 

salt/zeek/tools/sbin/so-zeek-cron

@@ -1,24 +0,0 @@
-#!/bin/bash
-
-# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
-# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
-# https://securityonion.net/license; you may not use this file except in compliance with the
-# Elastic License 2.0.
-
-# Run zeekctl's periodic maintenance tasks. This is what actually enforces
-# LogExpireInterval, StatsLogExpireInterval and CrashExpireInterval - without a periodic
-# 'zeekctl cron' those settings are inert no matter what they are set to.
-
-# This also restarts any node that died unexpectedly, and marks it crashed so a crash report
-# is produced. That is upstream's default cron behavior and it recovers a single node in
-# place. The beacon in salt/_beacons/zeek.py is the only other recovery path, it is disabled
-# by default (healthcheck:enabled), and it removes and recreates the whole container, so
-# letting zeekctl handle a single dead worker avoids the heavier restart.
-
-if ! docker ps --filter name=so-zeek --format '{{.Names}}' | grep -q '^so-zeek$'; then
-  exit 0
-fi
-
-# Run as the zeek user so the stats logs and zeekctl-config.sh this writes stay owned by
-# uid 937 rather than root.
-docker exec so-zeek runuser -l zeek -c '/opt/zeek/bin/zeekctl cron'