Merge pull request #16335 from Security-Onion-Solutions/esql-default-query

Refactor correlation template

salt/common/tools/sbin/so-log-check

@@ -178,6 +178,7 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Missing ory_kratos_session cookie" # expected WARN log lines indicating invalid auth header
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Static assets preprocessor only supports GET and HEAD requests" # expected WARN log lines indicating invalid auth header
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|respondError"                 # respondError is a function name, output via http middleware as standard request logging
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|GET /kibana/"                 # Ignore Kibana queries with triggered words
 fi
 
 if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then

salt/elasticfleet/integration-defaults.map.jinja

@@ -30,6 +30,8 @@
     'azure_metrics.monitor': 'azure.monitor',
     'azure_metrics.storage_account': 'azure.storage_account',
     'azure_openai.metrics': 'azure.open_ai',
+    'enterprisesearch.health': 'enterprisesearch.stack_monitoring.health',
+    'enterprisesearch.stats': 'enterprisesearch.stack_monitoring.stats',
     'kibana.cluster_actions': 'kibana.stack_monitoring.cluster_actions',
     'kibana.cluster_rules': 'kibana.stack_monitoring.cluster_rules',
     'kibana.node_actions': 'kibana.stack_monitoring.node_actions',

salt/elasticsearch/defaults.yaml

@@ -1,7 +1,7 @@
 elasticsearch:
   enabled: false
   esheap: '600m'
-  version: 9.4.5
+  version: 9.4.8
   index_clean: true
   data_retention_method: DLM
   vm:

salt/kibana/defaults.yaml

@@ -22,7 +22,7 @@ kibana:
           - default
           - file
     migrations:
-      discardCorruptObjects: "9.4.5"
+      discardCorruptObjects: "9.4.8"
     telemetry:
       enabled: False
     xpack:

salt/manager/tools/sbin/soup

@@ -1131,9 +1131,6 @@ post_to_3.2.0() {
 
 ### 3.3.0 Scripts ###
 up_to_3.3.0() {
-  # download 9.4.5 elastic agent packages
-  determine_elastic_agent_upgrade
-  
   # remove existing (patched) elasticsearch index template to match integration naming change
   if ! remove_elasticsearch_index_template "so-logs-sentinel_one_cloud_funnel.login" "sentinel_one_cloud_funnel.login changed to sentinel_one_cloud_funnel.logins"; then
     FINAL_MESSAGE_QUEUE+=("WARNING: Unable to automatically remove the so-logs-sentinel_one_cloud_funnel.login index template. This step can be performed manually using the following command:")
@@ -1166,10 +1163,6 @@ post_to_3.3.0() {
   # Recollate again since some internal DBs were excluded during 3.2.0 soup
   recollate_postgres
   
-  # Generate 9.4.5 elastic agent installers
-  echo "Regenerating Elastic Agent Installers"
-  /sbin/so-elastic-agent-gen-installers
-
   telegraf_repair
 
   set_postversion 3.3.0
@@ -1178,6 +1171,9 @@ post_to_3.3.0() {
 
 ### 3.4.0 Scripts ###
 up_to_3.4.0() {
+  # download 9.4.8 elastic agent packages
+  determine_elastic_agent_upgrade
+  
   set_soauth_range
 
   echo "Removing so-kratos, so-hydra and so-soc so they are recreated on the soauth network."
@@ -1255,6 +1251,10 @@ valid_soauth_range() {
 }
 
 post_to_3.4.0() {
+  # Generate 9.4.8 elastic agent installers
+  echo "Regenerating Elastic Agent Installers"
+  /sbin/so-elastic-agent-gen-installers
+  
   for idx in "metrics-logstash.node-default" "metrics-logstash.stack_monitoring.node-default"; do
     rollover_index "$idx"
   done
@@ -1548,9 +1548,10 @@ verify_es_version_compatibility() {
       ["8.18.4"]="8.18.6 8.18.8 9.0.8"
 	    ["8.18.6"]="8.18.8 9.0.8"
 	    ["8.18.8"]="9.0.8"
-      ["9.0.8"]="9.3.3 9.3.7 9.4.5"
+      ["9.0.8"]="9.3.3 9.3.7 9.4.5 9.4.8"
-      ["9.3.3"]="9.3.7 9.4.5"
+      ["9.3.3"]="9.3.7 9.4.5 9.4.8"
-      ["9.3.7"]="9.4.5"
+      ["9.3.7"]="9.4.5 9.4.8"
+      ["9.4.5"]="9.4.8"
     )
 
     # Elasticsearch MUST upgrade through these versions

salt/soc/defaults.yaml

@@ -1542,8 +1542,9 @@ soc:
           agentic: false
           agentMapping:
             Orchestrator: sonnet@SOAI
-            Investigator: gemma@SOAI
+            Investigator: haiku@SOAI
-            DetectionEngineer: gemma@SOAI
+            DetectionEngineer: haiku@SOAI
+            AlertTriage: haiku@SOAI
           useMemory: false
           useMemoryScanner: false
           dontScanBefore: ""
@@ -1570,6 +1571,7 @@ soc:
             tickIntervalSeconds: 60
             maxConcurrentItems: 4
             maxQueuedItems: 0
+            turnTimeoutSeconds: 300
             alertTriageEpoch: "2026-09-24T00:00:00Z"
           tools:
             filterEventFields:
@@ -1823,6 +1825,7 @@ soc:
         cacheExpirationMs: 300000
         casesEnabled: true
         detectionsEnabled: true
+        allowExternalMarkdownImages: false
         inactiveTools: ['toolUnused']
         exportNodeId:
         tools:
@@ -2524,6 +2527,9 @@ soc:
           queries:
             - name: 'Group By Name, Module'
               query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
+            - name: 'Group By Assessment, Name'
+              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
+              license: oai
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
               query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
             - name: 'Group By Source IP, Name'
@@ -2803,6 +2809,10 @@ soc:
               # Sigma correlation rule; requires ES|QL (useEsql).
               # First document: the correlation. Following documents: the rules it references.
               #
+              # This example mirrors the shipped rule c448c9f6 (Repeated SOC Login Failures For One Account).
+              # Change it before enabling, or you will get two alerts for the same activity.
+              # To test: log out of SOC and enter a wrong password 5 times for one username.
+              #
               # Types: event_count, value_count, temporal, value_sum, value_avg, value_median, value_percentile.
               # Correlation Guide: https://sigmahq.io/docs/meta/correlations.html
               # Logsources: https://sigmahq.io/docs/basics/log-sources.html
@@ -2811,46 +2821,45 @@ soc:
               id: [publicId]
               status: 'experimental'
               description: |
-                  Describe what the correlation finds and, importantly, why relating these
+                  Describe what the correlation finds and why relating these events is more
-                  events is more meaningful than either of them alone.
+                  meaningful than any one of them alone.
+                  Example: 5 or more failed SOC logins for one username in 10 minutes.
               references:
-                - 'https://local.invalid'
+                - 'https://attack.mitre.org/techniques/T1110/001/'
               author: '@SecurityOnion'
               date: '[today]'
               tags:
-                - detection.threat_hunting
+                - attack.credential-access
-                - attack.technique_id
+                - attack.t1110.001
               correlation:
-                  type: value_count
+                  type: event_count       # count the base rule's events...
                   rules:
-                      - example_base_rule  # the 'name' of the rule below
+                      - example_base_rule # ...by the 'name' of the rule below
                   group-by:
-                      - source.ip
+                      - user.name         # ...separately for each username
-                  # Xs, Xm, Xh, Xd or Xw.
+                  timespan: 10m           # Xs, Xm, Xh
-                  timespan: 10m
                   condition:
-                      field: dns.query.name
+                      gte: 5
-                      gte: 40
               falsepositives:
-                - 'Describe the benign activity that also produces this pattern'
+                - 'A user entering an old password after a password change'
               # Placeholders: %count%, %start%, %end%, %duration%, or any field.
-              summary: '%count% distinct names queried by %source.ip% in %duration%'
+              summary: '%count% failed SOC logins for %user.name% in %duration%, from %http.request.headers.x-real-ip%'
               level: 'medium'  # info | low | medium | high | critical
               ---
-              title: 'Base Event'
+              title: 'SOC Login Failure'
               # referenced by 'name' (or 'id')
               name: example_base_rule
-              description: 'The single event that the correlation aggregates.'
+              description: 'One failed SOC login. Put filters here, not in the correlation.'
               logsource:
-                category: network
+                product: kratos
-                service: dns
+                service: application
               detection:
                   selection:
-                      dns.query.name|exists: true
+                      msg: 'Encountered self-service login error.'
                   condition: selection
               # Carried into the alert.
               fields:
-                - dns.query.name
+                - http.request.headers.x-real-ip
         assistant:
           enabled: false
           investigationPrompt: Investigate Alert ID {socId}
@@ -2870,6 +2879,15 @@ soc:
               enabled: true
               adapter: SOAI
               charsPerTokenEstimate: 4
+            - id: haiku
+              displayName: Claude Haiku
+              origin: USA
+              contextLimitSmall: 1000000
+              contextLimitLarge: 1000000
+              lowBalanceColorAlert: 500000
+              enabled: true
+              adapter: SOAI
+              charsPerTokenEstimate: 4
             - id: gemma
               displayName: Gemma
               origin: USA

salt/soc/merged.map.jinja

@@ -22,6 +22,43 @@
 {% do SOCMERGED.config.server.update({'additionalCA': MANAGERMERGED.additionalCA}) %}
 {% do SOCMERGED.config.server.update({'insecureSkipVerify': MANAGERMERGED.insecureSkipVerify}) %}
 
+{# pillar.get replaces lists instead of merging them, so combine availableModels by id and alerts queries by name #}
+{% set default_models = {} %}
+{% for m in SOCDEFAULTS.config.server.client.assistant.availableModels %}
+{%   do default_models.setdefault(m.id, m) %}
+{% endfor %}
+{% set merged_models = [] %}
+{% set merged_ids = [] %}
+{% for m in SOCMERGED.config.server.client.assistant.availableModels or [] %}
+{%   set model = {} %}
+{%   do model.update(default_models.get(m.get('id'), {})) %}
+{%   do model.update(m) %}
+{%   do merged_models.append(model) %}
+{%   do merged_ids.append(m.get('id')) %}
+{% endfor %}
+{% for id, m in default_models.items() if id not in merged_ids %}
+{%   do merged_models.append(m) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.assistant.update({'availableModels': merged_models}) %}
+
+{% set default_queries = {} %}
+{% for q in SOCDEFAULTS.config.server.client.alerts.queries %}
+{%   do default_queries.setdefault(q.name, q) %}
+{% endfor %}
+{% set merged_queries = [] %}
+{% set merged_names = [] %}
+{% for q in SOCMERGED.config.server.client.alerts.queries or [] %}
+{%   set query = {} %}
+{%   do query.update(default_queries.get(q.get('name'), {})) %}
+{%   do query.update(q) %}
+{%   do merged_queries.append(query) %}
+{%   do merged_names.append(q.get('name')) %}
+{% endfor %}
+{% for name, q in default_queries.items() if name not in merged_names %}
+{%   do merged_queries.append(q) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.alerts.update({'queries': merged_queries}) %}
+
 {% if not SOCMERGED.config.server.modules.postgres.host %}
 {%   do SOCMERGED.config.server.modules.postgres.update({'host': GLOBALS.manager}) %}
 {% endif %}

salt/soc/soc_soc.yaml

@@ -525,6 +525,10 @@ soc:
             description: Enables or disables the SOC notification module.
             forcedType: bool
             global: True
+          connectionTimeoutSeconds:
+            description: Duration (in seconds) to wait for a response from the remote notification endpoint host before giving up.
+            forcedType: int
+            global: True
         postgres:
           host:
             description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.
@@ -949,6 +953,9 @@ soc:
             DetectionEngineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
+            AlertTriage:
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can send a notification but cannot acknowledge alerts or escalate to cases.
+              global: True
           useMemory:
             description: Enables the Memory system for OnionAI
             global: True
@@ -1051,11 +1058,18 @@ soc:
               global: True
               advanced: True
               forcedType: int
+            turnTimeoutSeconds:
+              description: Maximum number of seconds a single model turn of an automation's agent session may run, even while the model is still producing output. A turn that exceeds this limit is abandoned and the session is recorded as failed. Set to 0 to disable the timeout. Edit this setting via the Agent Studio.
+              global: True
+              advanced: True
+              forcedType: int
+              readonlyUi: True
             alertTriageEpoch:
               description: The earliest alert time the Alert Triage automation will consider. Alerts before this time are never triaged, which keeps a first run on an existing deployment from working through old history. Must be in UTC format (2026-09-24T00:00:00Z).
               regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'
               regexFailureMessage: Expecting date in RFC3339 format (2026-09-24T00:00:00Z)
               global: True
+              readonlyUi: True
               advanced: True
           tools:
             filterEventFields:
@@ -1163,6 +1177,10 @@ soc:
           description: Set to true to enable the Detections module in SOC.
           global: True
           forcedType: bool
+        allowExternalMarkdownImages:
+          description: Set to true to let user-written Markdown, such as case descriptions and comments, load images from other servers. Loading an image sends a request to its server, so leave this disabled unless needed; Onion AI output never loads external images.
+          global: True
+          forcedType: bool
         inactiveTools:
           description: List of external tools to remove from the SOC UI.
           global: True
@@ -1215,6 +1233,8 @@ soc:
             - field: showSubtitle
               label: Show Query in Dropdown.
               forcedType: bool
+            - field: license
+              label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere.
           queryToggleFilters:
             description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.
             global: True

salt/stig/files/sos-oscap.xml

@@ -1333,8 +1333,8 @@ DISA STIG for Oracle Linux 9 V1R3.</xccdf-1.2:description>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="false"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>
@@ -1935,8 +1935,8 @@ standard DISA STIG for Oracle Linux 9 profile.</xccdf-1.2:description>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="false"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
         <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>

setup/so-functions

@@ -1362,7 +1362,11 @@ create_global() {
 	echo "global:" >> $global_pillar_file
 	echo "  soversion: '$SOVERSION'" >> $global_pillar_file
 	echo "  managerip: '$MAINIP'" >> $global_pillar_file
-	echo "  mdengine: 'ZEEK'" >> $global_pillar_file
+	if [[ $is_eval ]] || [ "$install_type" = 'EVAL' ]; then
+		echo "  mdengine: 'SURICATA'" >> $global_pillar_file
+	else
+		echo "  mdengine: 'ZEEK'" >> $global_pillar_file
+	fi
 	echo "  ids: 'Suricata'" >> $global_pillar_file
 	echo "  url_base: '$REDIRECTIT'" >> $global_pillar_file
 	if [[ $is_airgap ]]; then