Merge pull request #16105 from Security-Onion-Solutions/fixESHEAP

Add default esheap value so nodes highstate without the pillar value

.github/DISCUSSION_TEMPLATE/3-0.yml

@@ -12,7 +12,6 @@ body:
         - 3.0.0
         - 3.1.0
         - 3.2.0
-        - 3.3.0
         - Other (please provide detail below)
     validations:
       required: true

DOWNLOAD_AND_VERIFY_ISO.md

@@ -1,17 +1,17 @@
-### 3.2.0-20260729 ISO image released on 2026/07/29
+### 3.1.0-20260528 ISO image released on 2026/05/28
 
 
 ### Download and Verify
 
-3.2.0-20260729 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-3.2.0-20260729.iso
+3.1.0-20260528 ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260528.iso
  
-MD5: B1E10F46DF872B655C29325DF965A4DB  
-SHA1: 0F3C7ED80F6D326B7A993C2F899B986320C01BF9  
-SHA256: 7465163C1D1ADFCDC3935530EAFB312E987C016941ADC11841B214553314D1FF  
+MD5: 9D6FF58DEEE24089D722C73169765B3E  
+SHA1: 2B8B816B6CEC3B7F96B3C5E040EBF502DD2C412F  
+SHA256: 62FAB57E247C843D6A04F0796D8162C732B65D82FC3E4A59D087135B9FD32912  
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.2.0-20260729.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260528.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS  
@@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.2.0-20260729.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260528.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-3.2.0-20260729.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260528.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-3.2.0-20260729.iso.sig securityonion-3.2.0-20260729.iso
+gpg --verify securityonion-3.1.0-20260528.iso.sig securityonion-3.1.0-20260528.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Tue 28 Jul 2026 06:17:34 PM EDT using RSA key ID FE507013
+gpg: Signature made Wed 27 May 2026 03:03:59 PM EDT using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.

VERSION

@@ -1 +1 @@
-3.3.0
+3.2.0

salt/common/tools/sbin/so-log-check

@@ -231,7 +231,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|from NIC checksum offloading" # zeek reporter.log
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|marked for removal"           # docker container getting recycled
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|tcp 127.0.0.1:6791: bind: address already in use" # so-elastic-fleet agent restarting. Seen starting w/ 8.18.8 https://github.com/elastic/kibana/issues/201459
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-.*user so_kibana lacks the required permissions" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-(tychon|aws_billing|microsoft_defender_endpoint|armis|o365_metrics|microsoft_sentinel|snyk|cyera|island_browser).*user so_kibana lacks the required permissions \[(logs|metrics)-\1" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user. This error should not be seen on fresh ES 9.3.3 installs or after SO 3.1.0 with soups addition of check_transform_health_and_reauthorize()
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|manifest unknown"             # appears in so-dockerregistry log for so-tcpreplay following docker upgrade to 29.2.1-1
 fi
 

salt/common/tools/sbin/so-restart

@@ -35,6 +35,9 @@ case $1 in
     "elastic-fleet"|"elasticfleet")
         docker_check_running "elastic-fleet" "--stop"
         docker rm "so-elastic-fleet" 2> /dev/null
+        # Removing the elastic fleet state directory, so that the next startup re-enrolls with a fresh policy
+        rm -rf /opt/so/conf/elastic-fleet/state
+
         salt-call state.apply elasticfleet queue=True
         ;;
     *)

salt/common/tools/sbin/so-stop

@@ -29,6 +29,8 @@ case $1 in
 	"elasticfleet"|"elastic-fleet")
         docker_check_running "elastic-fleet" "--stop"
         docker rm "so-elastic-fleet" 2> /dev/null
+        # Removing the elastic fleet state directory, so that the next startup re-enrolls with a fresh policy
+        rm -rf /opt/so/conf/elastic-fleet/state
         ;;
     *)
         docker_check_running "$1" "--stop"

salt/common/tools/sbin_jinja/so-salt-minion-check

@@ -25,7 +25,7 @@ LAST_HIGHSTATE_END=$([ -e "/opt/so/log/salt/lasthighstate" ] && date -r /opt/so/
 LAST_HEALTHCHECK_STATE_APPLY=$([ -e "/opt/so/log/salt/state-apply-test" ] && date -r /opt/so/log/salt/state-apply-test +%s || echo 0)
 # SETTING THRESHOLD TO ANYTHING UNDER 600 seconds may cause a lot of salt-minion restarts since the job to touch the file occurs every 5-8 minutes by default
 # THRESHOLD is derived from the salt schedule highstate interval + 1 hour, so the minion-check grace period tracks the schedule automatically.
-THRESHOLD=$(( ({{ SCHEDULEMERGED.highstate_interval_minutes }} + 60) * 60 )) #within how many seconds the file /opt/so/log/salt/state-apply-test must have been touched/modified before the salt minion is restarted
+THRESHOLD=$(( ({{ SCHEDULEMERGED.highstate_interval_hours }} + 1) * 3600 )) #within how many seconds the file /opt/so/log/salt/state-apply-test must have been touched/modified before the salt minion is restarted
 THRESHOLD_DATE=$((LAST_HEALTHCHECK_STATE_APPLY+THRESHOLD))
 
 logCmd() {

salt/elasticfleet/enabled.sls

@@ -11,6 +11,10 @@
 
 {#   This value is generated during node install and stored in minion pillar #}
 {%   set SERVICETOKEN = salt['pillar.get']('elasticfleet:config:server:es_token','') %}
+{#   Prevent Elastic Agent from re-enrolling with a new agent.id everytime the container starts up.
+       - if a fresh enrollment is needed use 'so-stop elasticfleet'
+       #}
+{%   set ENROLLED = salt['file.file_exists']('/opt/so/conf/elastic-fleet/state/fleet.enc') %}
 
 include:
   - ca
@@ -66,6 +70,7 @@ so-elastic-fleet:
       - /etc/pki/elasticfleet-server.crt:/etc/pki/elasticfleet-server.crt:ro
       - /etc/pki/elasticfleet-server.key:/etc/pki/elasticfleet-server.key:ro
       - /etc/pki/tls/certs/intca.crt:/etc/pki/tls/certs/intca.crt:ro
+      - /opt/so/conf/elastic-fleet/state:/usr/share/elastic-agent/state
       - /opt/so/log/elasticfleet:/usr/share/elastic-agent/logs 
      {% if DOCKERMERGED.containers['so-elastic-fleet'].custom_bind_mounts %}
         {% for BIND in DOCKERMERGED.containers['so-elastic-fleet'].custom_bind_mounts %}
@@ -73,6 +78,7 @@ so-elastic-fleet:
         {% endfor %}
       {% endif %}      
     - environment:
+      {% if not ENROLLED %}
       - FLEET_SERVER_ENABLE=true
       - FLEET_URL=https://{{ GLOBALS.hostname }}:8220
       - FLEET_SERVER_ELASTICSEARCH_HOST=https://{{ GLOBALS.manager }}:9200
@@ -82,6 +88,9 @@ so-elastic-fleet:
       - FLEET_SERVER_CERT_KEY=/etc/pki/elasticfleet-server.key
       - FLEET_CA=/etc/pki/tls/certs/intca.crt     
       - FLEET_SERVER_ELASTICSEARCH_CA=/etc/pki/tls/certs/intca.crt
+      {% endif %}
+      - STATE_PATH=/usr/share/elastic-agent/state
+      - CONFIG_PATH=/usr/share/elastic-agent/state
       - LOGS_PATH=logs
       {% if DOCKERMERGED.containers['so-elastic-fleet'].extra_env %}
         {% for XTRAENV in DOCKERMERGED.containers['so-elastic-fleet'].extra_env %}
@@ -100,6 +109,7 @@ so-elastic-fleet:
       - x509: etc_elasticfleet_crt
     - require:
       - file: trusttheca
+      - file: eastatedir
       - x509: etc_elasticfleet_key
       - x509: etc_elasticfleet_crt
 

salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade

@@ -17,7 +17,7 @@ if INSTALLED_VERSION=$(elastic_fleet_package_version_check "{{ PACKAGE }}") && L
     if [ "$INSTALLED_VERSION" == "$LATEST_VERSION" ]; then
         echo "{{ PACKAGE }} integration version $INSTALLED_VERSION is already at the reported latest version $LATEST_VERSION, skipping upgrade."
     else
-        echo "Upgrading {{ PACKAGE }} package from $INSTALLED_VERSION to version $LATEST_VERSION..."
+        echo "Upgrading {{ PACKAGE }} package to version $LATEST_VERSION..."
         if ! elastic_fleet_package_install "{{ PACKAGE }}" "$LATEST_VERSION"; then
             PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
             PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")

salt/elasticsearch/defaults.yaml

@@ -3454,720 +3454,6 @@ elasticsearch:
               set_priority:
                 priority: 50
             min_age: 30d
-    so-metrics-system_x_core:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.core@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.core@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.core@custom
-        index_patterns:
-        - metrics-system.core-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.core-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_cpu:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.cpu@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.cpu@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.cpu@custom
-        index_patterns:
-        - metrics-system.cpu-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.cpu-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_diskio:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.diskio@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.diskio@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.diskio@custom
-        index_patterns:
-        - metrics-system.diskio-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.diskio-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_filesystem:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.filesystem@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.filesystem@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.filesystem@custom
-        index_patterns:
-        - metrics-system.filesystem-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.filesystem-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_fsstat:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.fsstat@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.fsstat@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.fsstat@custom
-        index_patterns:
-        - metrics-system.fsstat-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.fsstat-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_load:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.load@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.load@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.load@custom
-        index_patterns:
-        - metrics-system.load-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.load-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_memory:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.memory@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.memory@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.memory@custom
-        index_patterns:
-        - metrics-system.memory-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.memory-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_network:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.network@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.network@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.network@custom
-        index_patterns:
-        - metrics-system.network-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.network-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_ntp:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@settings
-        - metrics-system.ntp@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.ntp@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.ntp@custom
-        index_patterns:
-        - metrics-system.ntp-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.ntp-logs
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_process:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.process@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.process@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.process@custom
-        index_patterns:
-        - metrics-system.process-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.process-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_process_x_summary:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.process.summary@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.process.summary@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.process.summary@custom
-        index_patterns:
-        - metrics-system.process.summary-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.process.summary-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_socket_summary:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.socket_summary@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.socket_summary@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.socket_summary@custom
-        index_patterns:
-        - metrics-system.socket_summary-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.socket_summary-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
-    so-metrics-system_x_uptime:
-      data_stream_lifecycle:
-        data_retention: 90d
-      index_template:
-        composed_of:
-        - metrics@tsdb-settings
-        - metrics-system.uptime@package
-        - metrics@custom
-        - system@custom
-        - metrics-system.uptime@custom
-        - ecs@mappings
-        - so-fleet_integrations.ip_mappings-1
-        - so-fleet_globals-1
-        - so-fleet_agent_id_verification-1
-        data_stream:
-          allow_custom_routing: false
-          hidden: false
-        ignore_missing_component_templates:
-        - metrics@custom
-        - system@custom
-        - metrics-system.uptime@custom
-        index_patterns:
-        - metrics-system.uptime-*
-        priority: 501
-        template:
-          settings:
-            index:
-              lifecycle:
-                name: so-metrics-system.uptime-logs
-              mode: time_series
-              number_of_replicas: 0
-      policy:
-        phases:
-          cold:
-            actions:
-              set_priority:
-                priority: 0
-            min_age: 60d
-          delete:
-            actions:
-              delete: {}
-            min_age: 365d
-          hot:
-            actions:
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-              set_priority:
-                priority: 100
-            min_age: 0ms
-          warm:
-            actions:
-              set_priority:
-                priority: 50
-            min_age: 30d
     so-logs-windows_x_forwarded:
       index_sorting: false
       data_stream_lifecycle:

salt/elasticsearch/files/log4j2.properties

@@ -20,8 +20,7 @@ appender.rolling.strategy.type = DefaultRolloverStrategy
 appender.rolling.strategy.action.type = Delete
 appender.rolling.strategy.action.basepath = /var/log/elasticsearch
 appender.rolling.strategy.action.condition.type = IfFileName
-# age delete regular securityonion.log.gz and gc.log.NN files
-appender.rolling.strategy.action.condition.regex = (?:.*[.]log[.]gz|gc[.]log[.][0-9]+)
+appender.rolling.strategy.action.condition.glob = *.log.gz
 appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
 appender.rolling.strategy.action.condition.nested_condition.age = 7D
 

salt/elasticsearch/soc_elasticsearch.yaml

@@ -64,43 +64,6 @@ elasticsearch:
               flood_stage:
                 description: The max percentage of used disk space that will cause the node to take protective actions, such as blocking incoming events.
                 helpLink: elasticsearch
-      lifecycle:
-        default:
-          rollover:
-            description: This property accepts a key value pair formatted string and configures the conditions that would trigger a data stream to rollover when it has lifecycle configured.
-            forcedType: string
-            regex: ^max_age=(auto|[1-9][0-9]*[hd]),max_primary_shard_size=[1-9][0-9]*gb,min_docs=(0|[1-9][0-9]*),max_primary_shard_docs=[1-9][0-9]*$
-            regexFailureMessage: Must be in the format of "max_age=auto|<number><h|d>,max_primary_shard_size=<number>gb,min_docs=<number>,max_primary_shard_docs=<number>".
-            advanced: True
-            global: True
-    data_streams:
-      lifecycle:
-        poll_interval:
-          description: How often Elasticsearch checks what the next action is for all data streams with a built-in lifecycle.
-          forcedType: string
-          regex: "^[1-9][0-9]*[mhd]$"
-          regexFailureMessage: Must be a number followed by m, h, or d.
-          advanced: True
-          global: true
-          helpLink: elasticsearch
-        target:
-          merge:
-            policy:
-              merge_factor:
-                description: Data stream lifecycle implements tail merging by updating the Lucene merge policy factor for the target backing index. The merge factor is both the number of segments that should be merged together, and the maximum number of segments that we expect to find.
-                forcedType: int
-                regex: "^[1-9][0-9]*$"
-                advanced: True
-                global: true
-                helpLink: elasticsearch
-              floor_segment:
-                description: Data stream lifecycle implements tail merging by updating the Lucene merge policy floor segment for the target backing index. This floor segment size is a way to prevent indices from having a long tail of very small segments.
-                forcedType: string
-                regex: "^[1-9][0-9]*[MG]B$"
-                regexFailureMessage: Must be a number followed by MB or GB, such as 100MB.
-                advanced: True
-                global: true
-                helpLink: elasticsearch
     action:
       destructive_requires_name:
         description: Requires explicit index names when deleting indices. Prevents accidental deletion of indices via wildcard patterns.
@@ -682,9 +645,6 @@ elasticsearch:
             global: True
             advanced: True
             helpLink: elasticsearch
-    so-assistant-chat: *dataStreamSettings
-    so-assistant-session: *dataStreamSettings
-    so-elastic-agent-monitor: *dataStreamSettings
     so-logs-soc: *dataStreamSettings
     so-logs-system_x_auth: *dataStreamSettings
     so-logs-system_x_syslog: *dataStreamSettings
@@ -707,10 +667,7 @@ elasticsearch:
     so-logs-elastic_agent_x_auditbeat: *dataStreamSettings
     so-logs-elastic_agent_x_cloudbeat: *dataStreamSettings
     so-logs-elastic_agent_x_endpoint_security: *dataStreamSettings
-    so-logs-endpoint_x_actions: *dataStreamSettings
-    so-logs-endpoint_x_action_x_responses: *dataStreamSettings
     so-logs-endpoint_x_alerts: *dataStreamSettings
-    so-logs-endpoint_x_diagnostic_x_collection: *dataStreamSettings
     so-logs-endpoint_x_events_x_api: *dataStreamSettings
     so-logs-endpoint_x_events_x_file: *dataStreamSettings
     so-logs-endpoint_x_events_x_library: *dataStreamSettings
@@ -718,7 +675,6 @@ elasticsearch:
     so-logs-endpoint_x_events_x_process: *dataStreamSettings
     so-logs-endpoint_x_events_x_registry: *dataStreamSettings
     so-logs-endpoint_x_events_x_security: *dataStreamSettings
-    so-logs-endpoint_x_heartbeat: *dataStreamSettings
     so-logs-elastic_agent_x_filebeat: *dataStreamSettings
     so-logs-elastic_agent_x_fleet_server: *dataStreamSettings
     so-logs-elastic_agent_x_heartbeat: *dataStreamSettings
@@ -734,19 +690,6 @@ elasticsearch:
     so-metrics-vsphere_x_datastore: *dataStreamSettings
     so-metrics-vsphere_x_host: *dataStreamSettings
     so-metrics-vsphere_x_virtualmachine: *dataStreamSettings
-    so-metrics-system_x_core: *dataStreamSettings
-    so-metrics-system_x_cpu: *dataStreamSettings
-    so-metrics-system_x_diskio: *dataStreamSettings
-    so-metrics-system_x_filesystem: *dataStreamSettings
-    so-metrics-system_x_fsstat: *dataStreamSettings
-    so-metrics-system_x_load: *dataStreamSettings
-    so-metrics-system_x_memory: *dataStreamSettings
-    so-metrics-system_x_network: *dataStreamSettings
-    so-metrics-system_x_ntp: *dataStreamSettings
-    so-metrics-system_x_process: *dataStreamSettings
-    so-metrics-system_x_process_x_summary: *dataStreamSettings
-    so-metrics-system_x_socket_summary: *dataStreamSettings
-    so-metrics-system_x_uptime: *dataStreamSettings
     so-common: *dataStreamSettings
     so-endgame: *dataStreamSettings
     so-idh: *dataStreamSettings
@@ -937,6 +880,17 @@ elasticsearch:
                   global: True
                   advanced: True
                   helpLink: elasticsearch
+              rollover:
+                max_age:
+                  description: Maximum age of index.  Once an index reaches this limit, it will be rolled over into a new index.
+                  global: True
+                  advanced: True
+                  helpLink: elasticsearch
+                max_primary_shard_size:
+                  description: Maximum primary shard size. Once an index reaches this limit, it will be rolled over into a new index.
+                  global: True
+                  advanced: True
+                  helpLink: elasticsearch
               shrink:
                 method:
                   description: Shrink the index to a new index with fewer primary shards. Shrink operation is by count or size.
@@ -1033,6 +987,8 @@ elasticsearch:
             helpLink: elasticsearch
     sos-backup: *indexSettings
     so-detection: *indexSettings
+    so-assistant-chat: *indexSettings
+    so-assistant-session: *indexSettings
     so-metrics-fleet_server_x_agent_status: &fleetMetricsSettings
       index_sorting:
         description: Sorts the index by event time, at the cost of additional processing resource consumption.

salt/elasticsearch/template.map.jinja

@@ -109,15 +109,9 @@
 {%     if not settings.get('index_sorting', False) | to_bool and settings.index_template.template.settings.index.sort is defined %}
 {%       do settings.index_template.template.settings.index.pop('sort') %}
 {%     endif %}
-{%     if DATA_RETENTION_METHOD == 'DLM' and settings.index_template.data_stream is defined %}
-{#       Addon defaults are generated without data_stream_lifecycle, so fall back to global defaults. #}
-{%       if settings.data_stream_lifecycle is defined %}
-{%         set DATA_STREAM_LIFECYCLE = settings.data_stream_lifecycle %}
-{%       else %}
-{%         set DATA_STREAM_LIFECYCLE = DEFAULT_GLOBAL_OVERRIDES.data_stream_lifecycle %}
-{%       endif %}
-{%       if DATA_STREAM_LIFECYCLE.data_retention is defined and DATA_STREAM_LIFECYCLE.data_retention %}
-{%         do settings.index_template.template.update({'lifecycle': {'data_retention': DATA_STREAM_LIFECYCLE.data_retention}}) %}
+{%     if DATA_RETENTION_METHOD == 'DLM' and settings.index_template.data_stream is defined and settings.data_stream_lifecycle is defined %}
+{%       if settings.data_stream_lifecycle.data_retention is defined and settings.data_stream_lifecycle.data_retention %}
+{%         do settings.index_template.template.update({'lifecycle': {'data_retention': settings.data_stream_lifecycle.data_retention}}) %}
 {%       else %}
 {%         do settings.index_template.template.update({'lifecycle': {}}) %}
 {%       endif %}

salt/manager/tools/sbin/soup

@@ -442,13 +442,7 @@ get_soup_script_hashes() {
 }
 
 highstate() {
-  # Run a highstate with a retry attempt.
-  if salt-call state.highstate -l info queue=True; then
-    return 0
-  fi
-
-  echo "Initial highstate attempt had a problem; retrying in 30 seconds."
-  sleep 30
+  # Run a highstate.
   salt-call state.highstate -l info queue=True
 }
 
@@ -479,7 +473,6 @@ preupgrade_changes() {
     [[ "$INSTALLEDVERSION" =~ ^2\.4\.21[0-9]+$ ]] && up_to_3.0.0
     [[ "$INSTALLEDVERSION" == "3.0.0" ]] && up_to_3.1.0
     [[ "$INSTALLEDVERSION" == "3.1.0" ]] && up_to_3.2.0
-    [[ "$INSTALLEDVERSION" == "3.2.0" ]] && up_to_3.3.0
     true
 }
 
@@ -497,7 +490,6 @@ postupgrade_changes() {
     [[ "$POSTVERSION" =~ ^2\.4\.21[0-9]+$ ]] && post_to_3.0.0
     [[ "$POSTVERSION" == "3.0.0" ]] && post_to_3.1.0
     [[ "$POSTVERSION" == "3.1.0" ]] && post_to_3.2.0
-    [[ "$POSTVERSION" == "3.2.0" ]] && post_to_3.3.0
     # All applicable post-upgrade steps completed; clear the resume marker.
     rm -f "$POSTVERSION_FILE"
     true
@@ -880,7 +872,7 @@ post_to_3.1.0() {
 recollate_postgres() {
   echo ""
   echo "Recollating PostgreSQL databases. The following output may contain warnings about a version mismatch, followed by a note indicating that the collation version has been changed."
-  for db in template1 postgres securityonion so_telegraf; do
+  for db in postgres securityonion so_telegraf; do
     docker exec so-postgres psql -U postgres $db -c "reindex database $db"
     docker exec so-postgres psql -U postgres $db -c "alter database $db refresh collation version"
   done
@@ -982,10 +974,6 @@ up_to_3.2.0() {
 
   pin_elasticsearch_data_retention_method
 
-  # Run so-elastic-fleet-es-url update with --force to ensure eval/import have
-  #  configured so-manager_elasicsearch as the default output for both monitoring and logs
-  /usr/sbin/so-elastic-fleet-es-url-update --force
-
   INSTALLEDVERSION=3.2.0
 }
 
@@ -1006,40 +994,9 @@ post_to_3.2.0() {
 
   set_postversion 3.2.0
 }
+
 ### 3.2.0 End ###
 
-### 3.2.0 Scripts ###
-up_to_3.3.0() {
-  INSTALLEDVERSION=3.3.0
-}
-
-telegraf_repair() {
-  # Only grids whose Telegraf partitions stalled need this; --check exits 1
-  # when there is something to repair, so everyone else is left alone.
-  local repair=/usr/sbin/so-telegraf-repair
-  [[ -x "$repair" ]] || return 0
-  docker ps --format '{{.Names}}' | grep -qx so-postgres || return 0
-
-  echo "Checking Telegraf metric partitions."
-  local status=0
-  "$repair" --check >> "$SOUP_LOG" 2>&1 || status=$?
-  case "$status" in
-    0) echo "  Telegraf partitions are healthy; nothing to repair." ;;
-    1) echo "  Repairing stalled Telegraf partitions."
-       "$repair" --yes \
-         || echo "  warning: so-telegraf-repair failed; run it manually" >&2 ;;
-    *) echo "  Skipping; Telegraf is not storing metrics in Postgres on this host." ;;
-  esac
-}
-
-post_to_3.3.0() {
-  # Recollate again since some internal DBs were excluded during 3.2.0 soup
-  recollate_postgres
-
-  telegraf_repair
-}
-### 3.3.0 End ###
-
 
 repo_sync() {
   echo "Sync the local repo."

salt/nginx/etc/nginx.conf

@@ -96,14 +96,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	Referrer-Policy             no-referrer;
+		add_header 	referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve X25519:secp521r1:secp384r1;
+		ssl_ecdh_curve secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
 	}
@@ -138,14 +138,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	Referrer-Policy             no-referrer;
+		add_header 	referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve X25519:secp521r1:secp384r1;
+		ssl_ecdh_curve secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
         location / {
@@ -172,14 +172,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	Referrer-Policy             no-referrer;
+		add_header 	referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve X25519:secp521r1:secp384r1;
+		ssl_ecdh_curve secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
 
@@ -198,10 +198,6 @@ http {
 		}
 
 		location / {
-			if ($http_authorization ~* "^Bearer .*$") {
-				return 401;
-			}
-
 			auth_request            /auth/sessions/whoami;
 			auth_request_set        $userid $upstream_http_x_kratos_authenticated_identity_id;
 			proxy_set_header        x-user-id $userid;
@@ -222,13 +218,6 @@ http {
 			add_header              Cache-Control "no-cache, no-store, must-revalidate";
 			add_header              Pragma "no-cache";
 			add_header              Expires "0";
-
-			add_header 	Content-Security-Policy     "default-src 'self' 'unsafe-inline' 'unsafe-eval' https: data: blob: wss:; frame-ancestors 'self'";
-			add_header 	X-Frame-Options             SAMEORIGIN;
-			add_header 	X-XSS-Protection            "1; mode=block";
-			add_header 	X-Content-Type-Options      nosniff;
-			add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-			add_header 	Referrer-Policy             no-referrer;
 		}
 
 		location ~ ^/auth/.*?(login|oidc/callback) {
@@ -394,11 +383,6 @@ http {
 			if ($http_authorization = "") {
 				return 403;
 			}
-
-			if ($http_authorization ~* "^Bearer .*$") {
-				return 401;
-			}
-
 			proxy_pass            http://{{ GLOBALS.manager }}:9822/;
 			proxy_read_timeout    90;
 			proxy_connect_timeout 90;
@@ -415,7 +399,7 @@ http {
 		error_page 429 = @error429;
 
 		location @error401 {
-			if ($request_uri ~* (^.*/api/.*|^.*/login.*|^.*/logout.*|^/connect/.*|^/oauth2/.*|^/.*\.map$)) {
+			if ($request_uri ~* (^.*/api/.*|^/connect/.*|^/oauth2/.*|^/.*\.map$)) {
 				return    401;
 			}
 

salt/postgres/defaults.yaml

@@ -16,4 +16,4 @@ postgres:
     logging_collector: 'off'
     log_min_messages: 'warning'
     shared_preload_libraries: pg_cron
-    cron.database_name: postgres
+    cron.database_name: so_telegraf

salt/postgres/soc_postgres.yaml

@@ -83,7 +83,7 @@ postgres:
       advanced: True
       helpLink: postgres
     cron.database_name:
-      description: Database pg_cron keeps its job metadata in. Must already exist when PostgreSQL starts, because pg_cron's launcher connects to it at startup and never retries if it is missing. The maintenance job itself targets so_telegraf.
+      description: Database pg_cron schedules jobs in. Must be so_telegraf so partman maintenance runs in the right database context.
       global: True
       advanced: True
       helpLink: postgres

salt/postgres/tools/sbin/so-postgres-backup

@@ -47,12 +47,7 @@ trap 'rm -f "$TMPFILE"' EXIT
 
 # Dump all databases and roles, compress. Write to a temp file so the final
 # filename only ever appears for a complete, verified backup.
-#
-# so_telegraf is excluded: it is transient metrics on a short retention window,
-# it dominates the dump size, and it is rebuilt automatically after a restore --
-# init-db.sh recreates the database and Telegraf recreates its tables on first
-# write. Roles are globals, so the per-minion telegraf logins are still dumped.
-if ! docker exec so-postgres pg_dumpall -U postgres --exclude-database=so_telegraf | gzip > "$TMPFILE"; then
+if ! docker exec so-postgres pg_dumpall -U postgres | gzip > "$TMPFILE"; then
   log "ERROR: pg_dumpall/gzip failed; backup aborted"
   exit 1
 fi

salt/postgres/tools/sbin/so-telegraf-postgres

@@ -5,18 +5,11 @@ set -e
 # Usage: so-telegraf-postgres <subcommand>
 #   create_db    Ensure the so_telegraf database exists.
 #   group_role   Provision the so_telegraf group role, telegraf/partman schemas,
-#                pg_partman, the so_admin maintenance routines, and the hourly
-#                pg_cron maintenance job.
+#                pg_partman, pg_cron, and the hourly partman maintenance job.
 #   user         Create or update a per-minion login role granted to so_telegraf.
 #                Env: ROLE_USER, ROLE_PASS.
-#   retention    Reconcile partman retention and premake on telegraf parents.
+#   retention    Reconcile partman retention on telegraf parents.
 #                Env: RETENTION_DAYS.
-#   maintenance  Drain default partitions and run partman maintenance.
-#   check        Report partition health. Non-zero if any parent is unhealthy.
-#
-# A default partition holding rows for a day blocks creating that day's child,
-# so maintenance drains defaults before calling partman. Use so-telegraf-repair
-# on a grid already stuck in that state.
 
 cmd="${1:?subcommand required}"
 
@@ -43,6 +36,7 @@ CREATE SCHEMA IF NOT EXISTS telegraf AUTHORIZATION so_telegraf;
 GRANT USAGE, CREATE ON SCHEMA telegraf TO so_telegraf;
 CREATE SCHEMA IF NOT EXISTS partman;
 CREATE EXTENSION IF NOT EXISTS pg_partman SCHEMA partman;
+CREATE EXTENSION IF NOT EXISTS pg_cron;
 -- Telegraf (running as so_telegraf) calls partman.create_parent()
 -- on first write of each metric, which needs USAGE on the partman
 -- schema, EXECUTE on its functions/procedures, and write access to
@@ -57,141 +51,12 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA partman
     GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO so_telegraf;
 ALTER DEFAULT PRIVILEGES IN SCHEMA partman
     GRANT USAGE, SELECT, UPDATE ON SEQUENCES TO so_telegraf;
-
--- pg_cron runs these as postgres, so they must not sit in a schema any
--- Telegraf role can create objects in.
-CREATE SCHEMA IF NOT EXISTS so_admin AUTHORIZATION postgres;
-REVOKE ALL ON SCHEMA so_admin FROM PUBLIC;
-
-CREATE OR REPLACE PROCEDURE so_admin.telegraf_maintenance()
-LANGUAGE plpgsql
-AS $proc$
-DECLARE
-    r          record;
-    v_default  text;
-    v_rows     bigint;
-BEGIN
-    -- No per-parent EXCEPTION handler: partition_data_proc commits internally,
-    -- and COMMIT is illegal while a subtransaction is active. A failing parent
-    -- aborts the run and the next pass retries.
-    FOR r IN
-        SELECT parent_table, retention
-        FROM partman.part_config
-        WHERE parent_table LIKE 'telegraf.%'
-        ORDER BY parent_table
-    LOOP
-        v_default := format('%I.%I',
-                            split_part(r.parent_table, '.', 1),
-                            split_part(r.parent_table, '.', 2) || '_default');
-
-        CONTINUE WHEN to_regclass(v_default) IS NULL;
-
-        EXECUTE format('SELECT count(*) FROM %s', v_default) INTO v_rows;
-        CONTINUE WHEN v_rows = 0;
-
-        RAISE WARNING 'so_admin.telegraf_maintenance: % rows stranded in %, draining',
-                      v_rows, v_default;
-
-        -- Cheaper to delete expired rows than to repartition and then drop them.
-        IF r.retention IS NOT NULL THEN
-            EXECUTE format('DELETE FROM %s WHERE "time" < now() - %L::interval',
-                           v_default, r.retention);
-            COMMIT;
-        END IF;
-
-        -- Bounded so a large backlog drains across several runs.
-        CALL partman.partition_data_proc(
-            p_parent_table := r.parent_table,
-            p_loop_count   := 200,
-            p_source_table := v_default
-        );
-        COMMIT;
-    END LOOP;
-
-    CALL partman.run_maintenance_proc();
-END;
-$proc$;
-
-CREATE OR REPLACE FUNCTION so_admin.telegraf_partition_status()
-RETURNS TABLE (
-    parent_table  text,
-    oldest_child  date,
-    newest_child  date,
-    days_ahead    int,
-    retention     text,
-    default_rows  bigint,
-    default_size  text
-)
-LANGUAGE plpgsql
-AS $func$
-DECLARE
-    r          record;
-    v_default  regclass;
-BEGIN
-    FOR r IN
-        SELECT pc.parent_table AS pt, pc.retention AS ret
-        FROM partman.part_config pc
-        WHERE pc.parent_table LIKE 'telegraf.%'
-        ORDER BY pc.parent_table
-    LOOP
-        parent_table := r.pt;
-        retention    := r.ret;
-
-        SELECT min(d), max(d) INTO oldest_child, newest_child
-        FROM (
-            SELECT to_date(substring(c.relname FROM '_p(\d{8})$'), 'YYYYMMDD') AS d
-            FROM pg_inherits i
-            JOIN pg_class c ON c.oid = i.inhrelid
-            WHERE i.inhparent = r.pt::regclass
-              AND pg_get_expr(c.relpartbound, c.oid) <> 'DEFAULT'
-        ) s;
-
-        days_ahead := newest_child - current_date;
-
-        v_default := to_regclass(format('%I.%I',
-                                        split_part(r.pt, '.', 1),
-                                        split_part(r.pt, '.', 2) || '_default'));
-        IF v_default IS NULL THEN
-            default_rows := NULL;
-            default_size := NULL;
-        ELSE
-            EXECUTE format('SELECT count(*) FROM %s', v_default::text) INTO default_rows;
-            default_size := pg_size_pretty(pg_total_relation_size(v_default));
-        END IF;
-
-        RETURN NEXT;
-    END LOOP;
-END;
-$func$;
-
--- Drop the registration older releases left in so_telegraf.
-SELECT CASE
-         WHEN current_setting('cron.database_name', true) IS DISTINCT FROM current_database()
-              AND EXISTS (SELECT 1 FROM pg_catalog.pg_extension WHERE extname = 'pg_cron')
-         THEN 'true' ELSE 'false'
-       END AS drop_stale_cron \gset
-\if :drop_stale_cron
-DROP EXTENSION pg_cron CASCADE;
-\endif
-EOSQL
-
-    # Guarded on the live GUC so applying this before the postgresql.conf change
-    # has restarted the container skips rather than failing.
-    docker exec -i so-postgres psql -v ON_ERROR_STOP=1 -U postgres -d postgres <<'EOSQL'
-SELECT CASE WHEN current_setting('cron.database_name', true) = current_database()
-            THEN 'true' ELSE 'false' END AS cron_here \gset
-\if :cron_here
-CREATE EXTENSION IF NOT EXISTS pg_cron;
--- cron.schedule_in_database is idempotent by jobname.
-SELECT cron.schedule_in_database(
+-- Hourly partman maintenance. cron.schedule is idempotent by jobname.
+SELECT cron.schedule(
   'telegraf-partman-maintenance',
   '17 * * * *',
-  'CALL so_admin.telegraf_maintenance()',
-  'so_telegraf'
+  'CALL partman.run_maintenance_proc()'
 );
-\else
-\echo 'pg_cron metadata database is not `postgres` yet; skipping job registration.'
-\endif
 EOSQL
     ;;
 
@@ -225,8 +90,6 @@ EOSQL
     : "${RETENTION_DAYS:?RETENTION_DAYS is required}"
     # \gset + \if guards against a missing pg_partman without using a DO
     # block (psql :var substitution doesn't reach into dollar-quoted code).
-    # premake is reconciled here because telegraf.conf only applies it to
-    # parents created from now on.
     docker exec -i so-postgres psql \
       -v ON_ERROR_STOP=1 \
       -v retention_days="$RETENTION_DAYS" \
@@ -234,60 +97,14 @@ EOSQL
 SELECT CASE WHEN EXISTS (SELECT 1 FROM pg_catalog.pg_extension WHERE extname = 'pg_partman')
             THEN 'true' ELSE 'false' END AS has_partman \gset
 \if :has_partman
--- infinite_time_partitions so a gap in metrics does not stop partman from
--- premaking forward, which is what leaves everything in the default.
 UPDATE partman.part_config
 SET retention = :'retention_days' || ' days',
-    retention_keep_table = false,
-    premake = 7,
-    infinite_time_partitions = true
+    retention_keep_table = false
 WHERE parent_table LIKE 'telegraf.%';
 \endif
 EOSQL
     ;;
 
-  maintenance)
-    docker exec -i so-postgres psql -v ON_ERROR_STOP=1 -U postgres -d so_telegraf <<'EOSQL'
-SELECT CASE WHEN to_regproc('so_admin.telegraf_maintenance') IS NOT NULL
-            THEN 'true' ELSE 'false' END AS has_proc \gset
-\if :has_proc
-CALL so_admin.telegraf_maintenance();
-\else
-\echo 'so_admin.telegraf_maintenance() is missing; run so-telegraf-postgres group_role first.'
-\endif
-EOSQL
-    ;;
-
-  check)
-    docker exec -i so-postgres psql -U postgres -d so_telegraf <<'EOSQL'
-\pset border 2
-SELECT * FROM so_admin.telegraf_partition_status();
-EOSQL
-    docker exec -i so-postgres psql -U postgres -d postgres <<'EOSQL'
-\pset border 2
-SELECT CASE WHEN to_regclass('cron.job_run_details') IS NOT NULL
-            THEN 'true' ELSE 'false' END AS has_cron \gset
-\if :has_cron
-SELECT d.status, d.return_message, d.start_time
-FROM cron.job_run_details d
-JOIN cron.job j ON j.jobid = d.jobid
-WHERE j.jobname = 'telegraf-partman-maintenance'
-ORDER BY d.start_time DESC
-LIMIT 5;
-\else
-\echo 'pg_cron is not installed in this database.'
-\endif
-EOSQL
-    unhealthy=$(docker exec so-postgres psql -U postgres -d so_telegraf -tAc \
-      "SELECT count(*) FROM so_admin.telegraf_partition_status()
-       WHERE coalesce(default_rows, 0) > 0 OR coalesce(days_ahead, -1) < 1")
-    if [ "${unhealthy:-1}" != "0" ]; then
-      echo "so-telegraf-postgres check: $unhealthy telegraf parent(s) unhealthy" >&2
-      exit 1
-    fi
-    echo "so-telegraf-postgres check: all telegraf parents healthy"
-    ;;
-
   *)
     echo "Unknown subcommand: $cmd" >&2
     exit 1

salt/postgres/tools/sbin/so-telegraf-repair

@@ -1,245 +0,0 @@
-#!/bin/bash
-
-# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
-# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
-# https://securityonion.net/license; you may not use this file except in compliance with the
-# Elastic License 2.0.
-
-# Put Telegraf metrics storage back in service on a grid where pg_partman
-# maintenance stalled: raises premake, discards the rows stranded in default
-# partitions, restarts so-postgres if pg_cron's launcher is dead, and runs
-# maintenance once. Healthy grids are reported and left alone.
-#
-# Usage: so-telegraf-repair [--check] [--yes] [--no-restart]
-#   --check       Report health and change nothing.
-#   --yes         Skip the confirmation prompt (for soup and other automation).
-#   --no-restart  Never restart so-postgres, even if pg_cron's launcher is dead.
-#
-# Exit status:
-#   0  healthy, or repair completed
-#   1  repair is needed (--check only)
-#   2  cannot run here: so-postgres, so_telegraf or pg_partman is missing
-
-set -e
-
-# Matches p_premake in telegraf.conf's create_parent template.
-PREMAKE=7
-JOB_NAME=telegraf-partman-maintenance
-
-CHECK_ONLY=false
-ASSUME_YES=false
-NO_RESTART=false
-
-usage() { sed -n '/^# Usage:/,/^#   2 /p' "$0" | sed 's/^# \?//'; }
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --check|--dry-run) CHECK_ONLY=true ;;
-    --yes|-y)          ASSUME_YES=true ;;
-    --no-restart)      NO_RESTART=true ;;
-    -h|--help)         usage; exit 0 ;;
-    *) echo "Unknown option: $1" >&2; usage >&2; exit 2 ;;
-  esac
-  shift
-done
-
-skip() { echo "$*"; exit 2; }
-
-psql_tg() { docker exec -i so-postgres psql -U postgres -d so_telegraf "$@"; }
-psql_pg() { docker exec -i so-postgres psql -U postgres -d postgres "$@"; }
-
-# query_to_xml so the per-table row counts need no helper function installed.
-REPORT="
-WITH parents AS (
-    SELECT pc.parent_table,
-           pc.premake,
-           split_part(pc.parent_table, '.', 1) AS sch,
-           split_part(pc.parent_table, '.', 2) AS tbl
-    FROM partman.part_config pc
-    WHERE pc.parent_table LIKE 'telegraf.%'
-), children AS (
-    SELECT p.parent_table,
-           max(to_date(substring(c.relname FROM '_p(\d{8})\$'), 'YYYYMMDD')) AS newest_child
-    FROM parents p
-    JOIN pg_class pt ON pt.oid = p.parent_table::regclass
-    JOIN pg_inherits i ON i.inhparent = pt.oid
-    JOIN pg_class c ON c.oid = i.inhrelid
-    WHERE pg_get_expr(c.relpartbound, c.oid) <> 'DEFAULT'
-    GROUP BY p.parent_table
-), defaults AS (
-    SELECT p.parent_table,
-           p.premake,
-           format('%I.%I', p.sch, p.tbl || '_default') AS default_table,
-           to_regclass(format('%I.%I', p.sch, p.tbl || '_default')) AS default_oid
-    FROM parents p
-)
-SELECT d.parent_table,
-       c.newest_child,
-       (c.newest_child - current_date) AS days_ahead,
-       d.premake,
-       CASE WHEN d.default_oid IS NULL THEN NULL ELSE
-            (xpath('/row/cnt/text()',
-                   query_to_xml(format('SELECT count(*) AS cnt FROM %s', d.default_table),
-                                false, true, '')))[1]::text::bigint
-       END AS default_rows,
-       CASE WHEN d.default_oid IS NULL THEN NULL
-            ELSE pg_size_pretty(pg_total_relation_size(d.default_oid)) END AS default_size
-FROM defaults d
-LEFT JOIN children c ON c.parent_table = d.parent_table
-ORDER BY 1
-"
-
-docker ps --format '{{.Names}}' | grep -qx so-postgres \
-  || skip "so-postgres is not running; nothing to repair."
-docker exec so-postgres psql -U postgres -tAc \
-  "SELECT 1 FROM pg_database WHERE datname='so_telegraf'" | grep -q 1 \
-  || skip "The so_telegraf database does not exist; Telegraf is not writing to Postgres."
-psql_tg -tAc "SELECT 1 FROM pg_extension WHERE extname='pg_partman'" | grep -q 1 \
-  || skip "pg_partman is not installed in so_telegraf; nothing to repair."
-
-parents=$(psql_tg -tAc \
-  "SELECT count(*) FROM partman.part_config WHERE parent_table LIKE 'telegraf.%'")
-stranded=$(psql_tg -tAc "SELECT coalesce(sum(default_rows), 0) FROM ( $REPORT ) t")
-behind=$(psql_tg -tAc \
-  "SELECT count(*) FROM ( $REPORT ) t WHERE coalesce(days_ahead, -1) < 1")
-# premake < 7, or infinite_time_partitions off: without the latter partman
-# refuses to premake forward across the gap the stall left behind.
-misconfigured=$(psql_tg -tAc \
-  "SELECT count(*) FROM partman.part_config
-    WHERE parent_table LIKE 'telegraf.%'
-      AND (premake < $PREMAKE OR NOT infinite_time_partitions)")
-
-# Both columns are matched because which one carries the launcher's name varies
-# with the pg_cron version.
-launcher=$(psql_pg -tAc \
-  "SELECT count(*) FROM pg_stat_activity
-    WHERE backend_type ILIKE '%pg_cron%' OR application_name ILIKE '%pg_cron%'")
-
-# so_telegraf before the postgres state lands, postgres after.
-cron_db=$(docker exec so-postgres psql -U postgres -tAc \
-  "SELECT current_setting('cron.database_name', true)" | tr -d '[:space:]')
-last_run=never
-if [[ -n "$cron_db" ]]; then
-  last_run=$(docker exec so-postgres psql -U postgres -d "$cron_db" -tAc \
-    "SELECT coalesce(max(d.start_time)::text, 'never')
-       FROM cron.job_run_details d JOIN cron.job j USING (jobid)
-      WHERE j.jobname = '$JOB_NAME'" 2>/dev/null | tr -d '[:space:]' || echo unknown)
-  [[ -n "$last_run" ]] || last_run=never
-fi
-
-# A grid that has never written a metric has nothing to recover, and an empty
-# cron_db means pg_cron is not loaded at all, which no restart fixes.
-restart_needed=false
-[[ "$launcher" -eq 0 && "$parents" -gt 0 && -n "$cron_db" ]] && restart_needed=true
-
-repair_needed=false
-[[ "$stranded" -gt 0 ]] && repair_needed=true
-[[ "$behind" -gt 0 ]] && repair_needed=true
-[[ "$misconfigured" -gt 0 ]] && repair_needed=true
-$restart_needed && repair_needed=true
-
-echo "Telegraf partition status:"
-psql_tg -c "$REPORT"
-echo "Rows stranded in default partitions: $stranded"
-echo "pg_cron metadata database: ${cron_db:-unset}"
-echo "pg_cron launcher running: $([[ "$launcher" -gt 0 ]] && echo yes || echo no)"
-echo "Last $JOB_NAME run: $last_run"
-echo
-
-if ! $repair_needed; then
-  echo "Telegraf partitions are healthy. Nothing to do."
-  exit 0
-fi
-
-if $CHECK_ONLY; then
-  echo "Repair is needed:"
-  [[ "$stranded" -gt 0 ]]    && echo "  * $stranded row(s) stranded in default partitions"
-  [[ "$behind" -gt 0 ]]      && echo "  * $behind parent(s) with no partition for the current window"
-  [[ "$misconfigured" -gt 0 ]] && echo "  * $misconfigured parent(s) with stale partman settings"
-  $restart_needed            && echo "  * pg_cron's launcher is dead; maintenance is not running at all"
-  echo
-  echo "Re-run without --check to repair."
-  exit 1
-fi
-
-if [[ "$stranded" -gt 0 ]] && ! $ASSUME_YES; then
-  echo "This will permanently discard the $stranded stranded row(s) above."
-  $restart_needed && ! $NO_RESTART && \
-    echo "so-postgres will also be restarted, which briefly interrupts SOC."
-  [[ -t 0 ]] || { echo "Not a terminal; re-run with --yes to confirm." >&2; exit 2; }
-  read -r -p "Continue? [y/N] " answer
-  [[ "$answer" =~ ^[Yy]$ ]] || { echo "Aborted."; exit 0; }
-fi
-
-if [[ "$misconfigured" -gt 0 ]]; then
-  echo "Reconciling partman settings on $misconfigured parent(s)."
-  # GREATEST so an operator who raised premake further keeps their value.
-  psql_tg -v ON_ERROR_STOP=1 -c \
-    "UPDATE partman.part_config
-        SET premake = GREATEST(premake, $PREMAKE),
-            infinite_time_partitions = true
-      WHERE parent_table LIKE 'telegraf.%'"
-fi
-
-if [[ "$stranded" -gt 0 ]]; then
-  echo "Clearing default partitions."
-  # One transaction: Telegraf is still writing, so a default emptied without
-  # its partition in place is refilled before maintenance can attach one.
-  psql_tg -v ON_ERROR_STOP=1 <<'EOSQL'
-DO $$
-DECLARE
-    r record;
-BEGIN
-    FOR r IN
-        SELECT pc.parent_table,
-               format('%I.%I', n.nspname, c.relname) AS default_table
-        FROM partman.part_config pc
-        JOIN pg_class p ON p.oid = pc.parent_table::regclass
-        JOIN pg_inherits i ON i.inhparent = p.oid
-        JOIN pg_class c ON c.oid = i.inhrelid
-        JOIN pg_namespace n ON n.oid = c.relnamespace
-        WHERE pc.parent_table LIKE 'telegraf.%'
-          AND pg_get_expr(c.relpartbound, c.oid) = 'DEFAULT'
-    LOOP
-        EXECUTE format('TRUNCATE TABLE %s', r.default_table);
-        PERFORM partman.create_partition_time(
-            r.parent_table, ARRAY[date_trunc('day', now())]::timestamptz[]);
-    END LOOP;
-END
-$$;
-EOSQL
-fi
-
-if $restart_needed; then
-  if $NO_RESTART; then
-    echo "WARNING: pg_cron's launcher is dead and --no-restart was given."
-    echo "         Maintenance will not run on its own until so-postgres is restarted."
-  else
-    echo "Restarting so-postgres to revive pg_cron's launcher."
-    docker restart so-postgres >/dev/null
-    for _ in $(seq 1 60); do
-      docker exec so-postgres pg_isready -U postgres -q 2>/dev/null && break
-      sleep 2
-    done
-    docker exec so-postgres pg_isready -U postgres -q \
-      || { echo "so-postgres did not come back; check 'docker logs so-postgres'." >&2; exit 1; }
-  fi
-fi
-
-echo "Running partition maintenance."
-# so_admin.telegraf_maintenance() only exists once the postgres state has landed.
-psql_tg -v ON_ERROR_STOP=1 <<'EOSQL'
-SELECT CASE WHEN to_regproc('so_admin.telegraf_maintenance') IS NOT NULL
-            THEN 'true' ELSE 'false' END AS has_proc \gset
-\if :has_proc
-CALL so_admin.telegraf_maintenance();
-\else
-CALL partman.run_maintenance_proc();
-\endif
-EOSQL
-
-echo
-echo "Telegraf partition status after repair:"
-psql_tg -c "$REPORT"
-echo "The $JOB_NAME job runs hourly at :17. Confirm it fired with:"
-echo "  so-telegraf-repair --check"

salt/reactor/pillar_push_map.yaml

@@ -242,7 +242,7 @@ versionlock:
 # grain (compound supports nested grain matching via G@<key>:<subkey>:<value>).
 # pillar/vm/soc_vm.sls write path is referenced at salt/_runners/setup_hypervisor.py:856.
 vm:
-  - state: vm.user
+  - state: vm
     tgt: 'G@salt-cloud:driver:libvirt'
 
 # zeek: sensor_roles + so-import (5 roles).

salt/repo/client/oracle.sls

@@ -60,9 +60,6 @@ so_repo:
   {% endif %}
     - enabled: 1
     - gpgcheck: 1
-  {% if not GLOBALS.is_manager %}
-    - sslverify: 0
-  {% endif %}
 
 # Only assign the kernel repo once this node's running salt matches the version this
 # SO release ships. During a soup the grid is mid-salt-upgrade; gating here keeps the
@@ -80,9 +77,6 @@ so_kernel_repo:
   {% endif %}
     - enabled: 1
     - gpgcheck: 1
-  {% if not GLOBALS.is_manager %}
-    - sslverify: 0
-  {% endif %}
     # Supplementary kernel repo: tolerate it being empty/unreachable (e.g. before the
     # manager has populated /nsm/kernelrepo) so a missing repomd.xml can't make every
     # dnf/pkg operation on the grid fail.

salt/salt/defaults.yaml

@@ -6,4 +6,4 @@ salt:
     batch: '25%'
     batch_wait: 15
   schedule:
-    highstate_interval_minutes: 120
+    highstate_interval_hours: 2

salt/salt/highstate_schedule.sls

@@ -1,15 +1,11 @@
 {% from 'vars/globals.map.jinja' import GLOBALS %}
 {% from 'salt/schedule.map.jinja' import SCHEDULEMERGED %}
 
-{# splay a quarter of the interval, clamped to [5 min, 30 min], so short intervals
-   don't get jitter larger than the interval itself #}
-{% set SPLAY = [[(SCHEDULEMERGED.highstate_interval_minutes * 60 // 4) | int, 300] | max, 1800] | min %}
-
 highstate_schedule:
   schedule.present:
     - function: state.highstate
-    - minutes: {{ SCHEDULEMERGED.highstate_interval_minutes }}
+    - hours: {{ SCHEDULEMERGED.highstate_interval_hours }}
     - maxrunning: 1
 {% if not GLOBALS.is_manager %}
-    - splay: {{ SPLAY }}
+    - splay: 1800
 {% endif %}

salt/salt/soc_salt.yaml

@@ -31,11 +31,9 @@ salt:
       global: True
       advanced: True
   schedule:
-    highstate_interval_minutes:
-      description: How often every minion in the grid runs a scheduled state.highstate, in minutes. Minimum 15 minutes. Lower values keep minions closer in sync at the cost of more load; higher values reduce load but increase worst-case latency for non-pushed changes. If Auto Apply is disabled, set this to the 15-minute minimum so changes are still picked up promptly. The salt-minion health check restarts a minion if its last state apply is older than this value plus one hour.
+    highstate_interval_hours:
+      description: How often every minion in the grid runs a scheduled state.highstate, in hours. Lower values keep minions closer in sync at the cost of more load; higher values reduce load but increase worst-case latency for non-pushed changes. The salt-minion health check restarts a minion if its last highstate is older than this value plus one hour.
       forcedType: int
       helpLink: push
       global: True
       advanced: True
-      regex: '^(1[5-9]|[2-9][0-9]|[1-9][0-9]{2,4})$'
-      regexFailureMessage: The value must be an integer of at least 15 minutes (maximum 99999).

salt/soc/defaults.yaml

@@ -1512,10 +1512,6 @@ soc:
                 rulesetName: sos-resources-ag
                 branch: main
                 folder: securityonion-normalized
-              - repo: file:///nsm/airgap-resources/playbooks/securityonion-resources-playbooks
-                rulesetName: sos-published-ag
-                branch: published
-                folder: sigma
         assistant:
           systemPromptAddendum: ""
           systemPromptAddendumMaxLength: 50000
@@ -1534,9 +1530,9 @@ soc:
               healthTimeoutSeconds: 5
           agentic: false
           agentMapping:
-            Orchestrator: sonnet@SOAI
-            Investigator: gemma@SOAI
-            DetectionEngineer: gemma@SOAI
+            Orchestrator: Claude Sonnet
+            Investigator: Claude Sonnet
+            Detection Engineer: Claude Sonnet
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false
@@ -2718,14 +2714,4 @@ soc:
               enabled: true
               adapter: SOAI
               charsPerTokenEstimate: 4
-            - id: gemma
-              displayName: Gemma
-              origin: USA
-              contextLimitSmall: 256000
-              contextLimitLarge: 256000
-              lowBalanceColorAlert: 500000
-              enabled: true
-              adapter: SOAI
-              charsPerTokenEstimate: 4
-              
             

salt/soc/files/soc/sigma_playbook_pipeline.yaml

@@ -12,30 +12,6 @@ transformations:
         process.command_line: process.command_line.caseless
         process.parent.command_line: process.parent.command_line.caseless
         file.path: file.path.caseless
-    # entity_id pivots must also match processes that were already running when the
-    # agent started: Defend emits already_running (event.type:info), not start.
-    # Kept out of Playbook sigma query because Sysmon has no equivalent concept.
-    # contains_field is exact, so child pivots (process.parent.entity_id) stay
-    # start-only. Drop must precede add;
-    - id: playbook_process_lifecycle_drop_start_scope
-      type: drop_detection_item
-      field_name_conditions:
-        - type: include_fields
-          fields: ['event.type']
-      rule_conditions:
-        - type: logsource
-          category: process_creation
-        - type: contains_field
-          field: process.entity_id
-    - id: playbook_process_lifecycle_add-fields
-      type: add_condition
-      conditions:
-        event.type: ['start', 'info']
-      rule_conditions:
-        - type: logsource
-          category: process_creation
-        - type: contains_field
-          field: process.entity_id
     # file_activity: playbook-only pseudo-category spanning all file operations.
     - id: playbook_file_activity_add-fields
       type: add_condition

salt/soc/files/soc/sigma_so_pipeline.yaml

@@ -46,47 +46,31 @@ transformations:
       - type: logsource
         product: opencanary
     # Maps "antivirus" category to Windows Defender logs shipped by Elastic Agent Winlog Integration
-    # and to Elastic Defend malware alerts
     # winlog.event_data.threat_name has to be renamed prior to ingestion, it is originally winlog.event_data.Threat Name
-    - id: antivirus_field-mappings
+    - id: antivirus_field-mappings_windows-defender
       type: field_name_mapping
       mapping:
-        Signature:
-          - winlog.event_data.threat_name
-          - rule.name
+        Signature: winlog.event_data.threat_name
       rule_conditions:
       - type: logsource
         category: antivirus
-    - id: antivirus_add-fields
+    - id: antivirus_add-fields_windows-defender
       type: add_condition
       conditions:
-        event.code:
-          - "1116"
-          - "malicious_file"
-          - "memory_signature"
+        winlog.channel: 'Microsoft-Windows-Windows Defender/Operational'
+        winlog.provider_name: 'Microsoft-Windows-Windows Defender'
+        event.code: "1116"
       rule_conditions:
       - type: logsource
         category: antivirus
     # OS-agnostic process_creation scoping for product-less (NIDS/host-pivot) rules.
-    # pySigma: rule_cond_expr requires rule_conditions as a mapping, not a list.
     - id: process_creation_os_agnostic
       type: add_condition
       conditions:
         event.category: process
       rule_conditions:
-        pc_cat:
-          type: logsource
-          category: process_creation
-        pc_win:
-          type: logsource
-          product: windows
-        pc_mac:
-          type: logsource
-          product: macos
-        pc_lin:
-          type: logsource
-          product: linux
-      rule_cond_expr: "pc_cat and not (pc_win or pc_mac or pc_lin)"
+      - type: logsource
+        category: process_creation
     # Transforms the `Hashes` field to ECS fields
     # ECS fields are used by the hash fields emitted by Elastic Defend
     # If shipped with Elastic Agent, sysmon logs will also have hashes mapped to ECS fields    
@@ -642,4 +626,4 @@ transformations:
         tags: '*file'
       rule_conditions:
       - type: logsource
-        category: file
+        category: file

salt/soc/soc_soc.yaml

@@ -786,7 +786,7 @@ soc:
             Investigator:
               description: This agent investigates alerts, explains events and records, and hunts through event data. It can also acknowledge alerts and escalate to cases.
               global: True
-            DetectionEngineer:
+            Detection Engineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
       client:

salt/telegraf/etc/telegraf.conf

@@ -122,7 +122,7 @@
   create_templates = [
     '''CREATE TABLE IF NOT EXISTS {{ .table }} ({{ .columns }}) PARTITION BY RANGE ("time")''',
     '''ALTER TABLE {{ .table }} ALTER COLUMN "time" SET NOT NULL''',
-    '''SELECT partman.create_parent(p_parent_table := {{ printf "%s.%s" .table.Schema .table.Name | quoteLiteral }}, p_control := 'time', p_type := 'range', p_interval := '1 day', p_premake := 7) WHERE NOT EXISTS (SELECT 1 FROM partman.part_config WHERE parent_table = {{ printf "%s.%s" .table.Schema .table.Name | quoteLiteral }})'''
+    '''SELECT partman.create_parent(p_parent_table := {{ printf "%s.%s" .table.Schema .table.Name | quoteLiteral }}, p_control := 'time', p_type := 'range', p_interval := '1 day', p_premake := 3) WHERE NOT EXISTS (SELECT 1 FROM partman.part_config WHERE parent_table = {{ printf "%s.%s" .table.Schema .table.Name | quoteLiteral }})'''
   ]
   tag_table_create_templates = [
     '''CREATE TABLE IF NOT EXISTS {{ .table }} ({{ .columns }}, PRIMARY KEY (tag_id))'''

salt/zeek/defaults.yaml

@@ -62,6 +62,7 @@ zeek:
         - securityonion/file-extraction
         - securityonion/community-id-extended
         - oui-logging
+        - icsnpp-modbus
         - icsnpp-dnp3
         - icsnpp-bacnet
         - icsnpp-ethercat