Specify Default Embed Model

Added `memoryScanIntervalSeconds` with a default of 5 mins.

Opted to set `useMemoryScanner` to false so by default our user's sessions are not sent to the cloud before they have a chance to configure the new setting.

salt/logstash/config.sls

@@ -81,10 +81,6 @@ ls_custom_pipeline_conf_{{assigned_pipeline}}_{{pipeline}}:
 
 
 {% for assigned_pipeline in ASSIGNED_PIPELINES %}
-{# a blank per-pipeline setting falls back to the global logstash.yml value #}
-{% set PIPELINE_OVERRIDES = LOGSTASH_MERGED.get('pipeline_settings', {}).get(assigned_pipeline, {}) %}
-{% set THREADS = PIPELINE_OVERRIDES.get('pipeline_x_workers') or LOGSTASH_MERGED.config.pipeline_x_workers %}
-{% set BATCH = PIPELINE_OVERRIDES.get('pipeline_x_batch_x_size') or LOGSTASH_MERGED.config.pipeline_x_batch_x_size %}
     {% for CONFIGFILE in LOGSTASH_MERGED.defined_pipelines[assigned_pipeline] %}
 ls_pipeline_{{assigned_pipeline}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}:
   file.managed:
@@ -96,8 +92,8 @@ ls_pipeline_{{assigned_pipeline}}_{{CONFIGFILE.split('.')[0] | replace("/","_")
         GLOBALS: {{ GLOBALS }}
         ES_USER: "{{ salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') }}"
         ES_PASS: "{{ salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') }}"
-        THREADS: {{ THREADS }}
-        BATCH: {{ BATCH }}
+        THREADS: {{ LOGSTASH_MERGED.config.pipeline_x_workers }}
+        BATCH: {{ LOGSTASH_MERGED.config.pipeline_x_batch_x_size }}
       {% else %}
     - name: /opt/so/conf/logstash/pipelines/{{assigned_pipeline}}/{{CONFIGFILE.split('/')[1]}}
       {% endif %}

salt/logstash/defaults.yaml

@@ -60,259 +60,6 @@ logstash:
     custom008: PLACEHOLDER
     custom009: PLACEHOLDER
     custom010: PLACEHOLDER
-  pipeline_settings:
-    fleet:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    manager:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    receiver:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    search:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    custom0:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    custom1:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    custom2:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    custom3:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
-    custom4:
-      pipeline_x_workers: ''
-      pipeline_x_batch_x_size: ''
-      pipeline_x_batch_x_delay: ''
-      pipeline_x_batch_x_metrics_x_sampling_mode: ''
-      pipeline_x_ordered: ''
-      pipeline_x_ecs_compatibility: ''
-      pipeline_x_reloadable: ''
-      queue_x_type: ''
-      queue_x_max_bytes: ''
-      queue_x_page_capacity: ''
-      queue_x_max_events: ''
-      queue_x_checkpoint_x_acks: ''
-      queue_x_checkpoint_x_writes: ''
-      queue_x_checkpoint_x_interval: ''
-      queue_x_checkpoint_x_retry: ''
-      queue_x_compression: ''
-      queue_x_drain: ''
-      dead_letter_queue_x_enable: ''
-      dead_letter_queue_x_max_bytes: ''
-      dead_letter_queue_x_flush_interval: ''
-      dead_letter_queue_x_flush_check_interval: ''
-      dead_letter_queue_x_storage_policy: ''
-      dead_letter_queue_x_retain_x_age: ''
-      path_x_queue: ''
-      path_x_dead_letter_queue: ''
-      config_x_debug: ''
-      config_x_support_escapes: ''
   settings:
     lsheap: 500m
   config:

salt/logstash/enabled.sls

@@ -105,7 +105,6 @@ so-logstash:
     {% endif %}
     - watch:
       - file: lsetcsync
-      - file: lspipelinesyml
       - file: trusttheca
       {% if GLOBALS.is_manager %}
       - file: elasticsearch_cacerts

salt/logstash/etc/pipelines.yml.jinja

@@ -1,17 +1,4 @@
-{%- from 'logstash/map.jinja' import LOGSTASH_MERGED %}
-{%- set PIPELINE_SETTINGS = LOGSTASH_MERGED.get('pipeline_settings', {}) %}
 {%- for assigned_pipeline in ASSIGNED_PIPELINES %}
 - pipeline.id: {{ assigned_pipeline }}
   path.config: "/usr/share/logstash/pipelines/{{ assigned_pipeline }}/"
-{%-   set extra = PIPELINE_SETTINGS.get(assigned_pipeline, {}) %}
-{%-   if extra is mapping %}
-{#-     values are emitted unquoted so yaml re-infers the type logstash expects:
-        4 as an integer, false as a boolean, 1024mb and auto as strings #}
-{%-     for key, value in extra | dictsort %}
-{%-       set rendered = key | replace('_x_', '.') %}
-{%-       if value not in ['', None] and rendered not in ['pipeline.id', 'path.config'] %}
-  {{ rendered }}: {{ value }}
-{%-       endif %}
-{%-     endfor %}
-{%-   endif %}
 {% endfor -%}

salt/logstash/soc_logstash.yaml

@@ -16,7 +16,6 @@ logstash:
       heavynode: *assigned_pipelines
       searchnode: *assigned_pipelines
       manager: *assigned_pipelines
-      managerhype: *assigned_pipelines
       managersearch: *assigned_pipelines
       fleet: *assigned_pipelines
   defined_pipelines:
@@ -52,322 +51,6 @@ logstash:
     custom008: *pipeline_config
     custom009: *pipeline_config
     custom010: *pipeline_config
-  pipeline_settings:
-    manager: &pipeline_settings
-      pipeline_x_workers:
-        description: >-
-          Number of worker threads that run filters and outputs for this pipeline. May be set higher
-          than the CPU core count when outputs spend time waiting on I/O. Leave blank to use the value
-          from logstash.yml.
-        title: pipeline.workers
-        regex: '^$|^[1-9][0-9]*$'
-        regexFailureMessage: Must be blank, or a positive whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      pipeline_x_batch_x_size:
-        description: >-
-          Maximum number of events an individual worker thread collects before running filters and
-          outputs. Larger batches are more efficient but increase heap use; total in-flight events is
-          workers multiplied by batch size. Leave blank to use the value from logstash.yml.
-        title: pipeline.batch.size
-        regex: '^$|^[1-9][0-9]*$'
-        regexFailureMessage: Must be blank, or a positive whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      pipeline_x_batch_x_delay:
-        description: >-
-          Milliseconds a worker waits for the next event before running a batch that is not yet full.
-          Leave blank to use the value from logstash.yml.
-        title: pipeline.batch.delay
-        regex: '^$|^[0-9]+$'
-        regexFailureMessage: Must be blank, or a whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      pipeline_x_batch_x_metrics_x_sampling_mode:
-        description: >-
-          How much batch size metering this pipeline records. Fuller sampling helps size batches but
-          consumes additional heap. Leave blank to use the value from logstash.yml.
-        title: pipeline.batch.metrics.sampling_mode
-        options:
-        - ''
-        - 'disabled'
-        - 'minimal'
-        - 'full'
-        advanced: True
-        global: False
-        helpLink: logstash
-      pipeline_x_ordered:
-        description: >-
-          Whether event order is preserved through this pipeline. auto enables ordering only when the
-          pipeline runs a single worker. Leave blank to use the value from logstash.yml.
-        title: pipeline.ordered
-        options:
-        - ''
-        - 'auto'
-        - 'true'
-        - 'false'
-        advanced: True
-        global: False
-        helpLink: logstash
-      pipeline_x_ecs_compatibility:
-        description: >-
-          Elastic Common Schema compatibility mode for plugins in this pipeline. Security Onion sets
-          this globally and it should rarely be changed per pipeline. Leave blank to use the value
-          from logstash.yml.
-        title: pipeline.ecs_compatibility
-        options:
-        - ''
-        - 'disabled'
-        - 'v1'
-        - 'v8'
-        advanced: True
-        global: False
-        helpLink: logstash
-      pipeline_x_reloadable:
-        description: >-
-          Whether this pipeline may be reloaded when its configuration changes. Leave blank to use the
-          value from logstash.yml.
-        title: pipeline.reloadable
-        options:
-        - ''
-        - 'true'
-        - 'false'
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_type:
-        description: >-
-          Queue backing this pipeline. persisted buffers events to disk under /nsm/logstash so they
-          survive a restart, at some throughput cost; memory does not. Leave blank to use the value
-          from logstash.yml.
-        title: queue.type
-        options:
-        - ''
-        - 'memory'
-        - 'persisted'
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_max_bytes:
-        description: >-
-          Total size of the persistent queue for this pipeline. Only applies when queue.type is
-          persisted, and must fit the disk backing /nsm/logstash. Leave blank to use the value from
-          logstash.yml.
-        title: queue.max_bytes
-        regex: '^$|^[0-9]+(b|kb|mb|gb|tb|pb)$'
-        regexFailureMessage: Must be blank, or a size such as 512mb, 1gb.
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_page_capacity:
-        description: >-
-          Size of each page in the persistent queue for this pipeline. Leave blank to use the value
-          from logstash.yml.
-        title: queue.page_capacity
-        regex: '^$|^[0-9]+(b|kb|mb|gb|tb|pb)$'
-        regexFailureMessage: Must be blank, or a size such as 512mb, 1gb.
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_max_events:
-        description: >-
-          Maximum number of events in the persistent queue for this pipeline. 0 means unlimited. Leave
-          blank to use the value from logstash.yml.
-        title: queue.max_events
-        regex: '^$|^[0-9]+$'
-        regexFailureMessage: Must be blank, or a whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_checkpoint_x_acks:
-        description: >-
-          Number of acknowledged events before a persistent queue checkpoint is forced. 0 means
-          unlimited. Leave blank to use the value from logstash.yml.
-        title: queue.checkpoint.acks
-        regex: '^$|^[0-9]+$'
-        regexFailureMessage: Must be blank, or a whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_checkpoint_x_writes:
-        description: >-
-          Number of written events before a persistent queue checkpoint is forced. 0 means unlimited.
-          Leave blank to use the value from logstash.yml.
-        title: queue.checkpoint.writes
-        regex: '^$|^[0-9]+$'
-        regexFailureMessage: Must be blank, or a whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_checkpoint_x_interval:
-        description: >-
-          Milliseconds between persistent queue head page checkpoints. 0 disables periodic
-          checkpointing. Leave blank to use the value from logstash.yml.
-        title: queue.checkpoint.interval
-        regex: '^$|^[0-9]+$'
-        regexFailureMessage: Must be blank, or a whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_checkpoint_x_retry:
-        description: >-
-          Whether Logstash retries a failed persistent queue checkpoint write. Leave blank to use the
-          value from logstash.yml.
-        title: queue.checkpoint.retry
-        options:
-        - ''
-        - 'true'
-        - 'false'
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_compression:
-        description: >-
-          Compression applied to persistent queue pages for this pipeline, trading CPU for disk. Leave
-          blank to use the value from logstash.yml.
-        title: queue.compression
-        options:
-        - ''
-        - 'none'
-        - 'speed'
-        - 'balanced'
-        - 'size'
-        - 'disabled'
-        advanced: True
-        global: False
-        helpLink: logstash
-      queue_x_drain:
-        description: >-
-          Whether Logstash drains the persistent queue before shutting down this pipeline. Draining a
-          large queue makes shutdown take considerably longer. Leave blank to use the value from
-          logstash.yml.
-        title: queue.drain
-        options:
-        - ''
-        - 'true'
-        - 'false'
-        advanced: True
-        global: False
-        helpLink: logstash
-      dead_letter_queue_x_enable:
-        description: >-
-          Whether events this pipeline cannot process are written to a dead letter queue instead of
-          being dropped. Leave blank to use the value from logstash.yml.
-        title: dead_letter_queue.enable
-        options:
-        - ''
-        - 'true'
-        - 'false'
-        advanced: True
-        global: False
-        helpLink: logstash
-      dead_letter_queue_x_max_bytes:
-        description: >-
-          Total size of the dead letter queue for this pipeline. Leave blank to use the value from
-          logstash.yml.
-        title: dead_letter_queue.max_bytes
-        regex: '^$|^[0-9]+(b|kb|mb|gb|tb|pb)$'
-        regexFailureMessage: Must be blank, or a size such as 512mb, 1gb.
-        advanced: True
-        global: False
-        helpLink: logstash
-      dead_letter_queue_x_flush_interval:
-        description: >-
-          Milliseconds before a partial dead letter queue segment is flushed. Leave blank to use the
-          value from logstash.yml.
-        title: dead_letter_queue.flush_interval
-        regex: '^$|^[0-9]+$'
-        regexFailureMessage: Must be blank, or a whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      dead_letter_queue_x_flush_check_interval:
-        description: >-
-          Milliseconds between checks for a dead letter queue segment that needs flushing. Leave blank
-          to use the value from logstash.yml.
-        title: dead_letter_queue.flush_check_interval
-        regex: '^$|^[0-9]+$'
-        regexFailureMessage: Must be blank, or a whole number.
-        advanced: True
-        global: False
-        helpLink: logstash
-      dead_letter_queue_x_storage_policy:
-        description: >-
-          What happens when the dead letter queue is full: drop_newer discards incoming events,
-          drop_older discards the oldest stored events. Leave blank to use the value from
-          logstash.yml.
-        title: dead_letter_queue.storage_policy
-        options:
-        - ''
-        - 'drop_newer'
-        - 'drop_older'
-        advanced: True
-        global: False
-        helpLink: logstash
-      dead_letter_queue_x_retain_x_age:
-        description: >-
-          How long an event is kept in the dead letter queue before removal, such as 5d. Leave blank
-          to use the value from logstash.yml.
-        title: dead_letter_queue.retain.age
-        regex: '^$|^[0-9]+[dhms]$'
-        regexFailureMessage: Must be blank, or a number followed by d, h, m, or s, such as 5d.
-        advanced: True
-        global: False
-        helpLink: logstash
-      path_x_queue:
-        description: >-
-          Directory inside the Logstash container holding the persistent queue for this pipeline. The
-          default lives under the /nsm/logstash bind mount; a path outside it will not survive a
-          container restart. Leave blank to use the value from logstash.yml.
-        title: path.queue
-        advanced: True
-        global: False
-        helpLink: logstash
-      path_x_dead_letter_queue:
-        description: >-
-          Directory inside the Logstash container holding the dead letter queue for this pipeline. The
-          default lives under the /nsm/logstash bind mount; a path outside it will not survive a
-          container restart. Leave blank to use the value from logstash.yml.
-        title: path.dead_letter_queue
-        advanced: True
-        global: False
-        helpLink: logstash
-      config_x_debug:
-        description: >-
-          Whether the fully compiled configuration for this pipeline is written to the log. The output
-          may contain sensitive values from the pipeline configuration. Leave blank to use the value
-          from logstash.yml.
-        title: config.debug
-        options:
-        - ''
-        - 'true'
-        - 'false'
-        advanced: True
-        global: False
-        helpLink: logstash
-      config_x_support_escapes:
-        description: >-
-          Whether escape sequences such as \n and \t in this pipeline's quoted strings are
-          interpreted. Leave blank to use the value from logstash.yml.
-        title: config.support_escapes
-        options:
-        - ''
-        - 'true'
-        - 'false'
-        advanced: True
-        global: False
-        helpLink: logstash
-    fleet: *pipeline_settings
-    receiver: *pipeline_settings
-    search: *pipeline_settings
-    custom0: *pipeline_settings
-    custom1: *pipeline_settings
-    custom2: *pipeline_settings
-    custom3: *pipeline_settings
-    custom4: *pipeline_settings
   settings:
     lsheap: 
       description: Heap size to use for logstash

salt/salt/minion/boot_highstate.sls

@@ -3,8 +3,6 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{% from 'vars/globals.map.jinja' import GLOBALS %}
-
 # Manages /etc/systemd/system/so-boot-highstate.service, a Type=oneshot
 # RemainAfterExit=yes unit that runs `salt-call state.highstate` exactly once
 # per system boot. Replaces the legacy `startup_states: highstate` minion
@@ -21,25 +19,9 @@ so_boot_highstate_unit_file:
     - onchanges_in:
       - module: systemd_reload
 
-# Non-managers never apply salt.minion during setup, so reaching this state means
-# setup is finished and the marker is safe to write unconditionally. This also
-# heals nodes installed before this fix, which have no marker and no legacy
-# startup_states line to grep for. Managers do highstate mid-setup, so they only
-# get the marker from the legacy upgrade signal; fresh installs get it from
-# mark_setup_complete in setup/so-functions.
-mark_setup_complete:
-  file.managed:
-    - name: /opt/so/state/setup-complete
-    - replace: false
-    - makedirs: True
-{% if GLOBALS.is_manager %}
-    - onlyif: "grep -qx 'startup_states: highstate' /etc/salt/minion"
-{% endif %}
-    - require_in:
-      - service: so_boot_highstate_service
-
 # Only enable once setup is complete. Until then the gate file is missing and
-# the unit's own ConditionPathExists would no-op it anyway.
+# the unit's own ConditionPathExists would no-op it anyway -- this just keeps
+# `systemctl is-enabled` honest for the sync_es_users gate.
 so_boot_highstate_service:
   service.enabled:
     - name: so-boot-highstate.service

salt/salt/minion/init.sls

@@ -87,15 +87,27 @@ set_log_levels:
 # so-boot-highstate.service (managed in salt.minion.boot_highstate), which
 # runs once per system boot only. Strip the line from /etc/salt/minion on
 # upgrade; both the commented and uncommented forms historically existed.
-# Ordered after mark_setup_complete (salt.minion.boot_highstate); the manager
-# gate there greps for this line, so it must run before we delete it.
 remove_startup_states:
   file.line:
     - name: /etc/salt/minion
     - match: 'startup_states: highstate'
     - mode: delete
-    - require:
-      - file: mark_setup_complete
+
+# Upgrade-path bridge: systems that already passed setup under the old gate
+# (`grep -x 'startup_states: highstate' /etc/salt/minion`) get a /opt/so/state/setup-complete
+# marker so so-boot-highstate.service can be enabled and the so-user_sync cron
+# in sync_es_users.sls keeps installing. Setup-in-progress systems instead get
+# the marker from `mark_setup_complete` in setup/so-functions at the right
+# moment. `replace: false` means we never overwrite a marker once written.
+mark_setup_complete_for_upgrades:
+  file.managed:
+    - name: /opt/so/state/setup-complete
+    - replace: false
+    - makedirs: True
+    - onlyif: "grep -qx 'startup_states: highstate' /etc/salt/minion"
+    - require_in:
+      - file: remove_startup_states
+      - service: so_boot_highstate_service
 
 {% endif %}
 

salt/setup/virt/setSalt.sls

@@ -8,15 +8,6 @@ set_role_grain:
     - name: role
     - value: so-{{ grains.id.split("_") | last }}
 
-# salt-cloud guests never run so-setup, so nothing else marks them setup-complete.
-# Replaces the 'startup_states: highstate' line this state used to append. No
-# GLOBALS import -- this runs before the guest's pillars exist.
-mark_setup_complete_vm_guest:
-  file.managed:
-    - name: /opt/so/state/setup-complete
-    - replace: false
-    - makedirs: True
-
 enable_salt_minion:
   service.enabled:
     - name: salt-minion

salt/soc/defaults.yaml

@@ -1537,6 +1537,18 @@ soc:
             Orchestrator: sonnet@SOAI
             Investigator: gemma@SOAI
             DetectionEngineer: gemma@SOAI
+          useMemory: true
+          useMemoryScanner: false
+          memoryScanIntervalSeconds: 300
+          memoryProximityThreshold: 0.8
+          messageProximityThreshold: 0.5
+          maxUserMemoriesToInclude: 5
+          maxGlobalMemoriesToInclude: 5
+          maxUserMemoriesToReconcile: 20
+          maxGlobalMemoriesToReconcile: 20
+          memoryModel: gemma@SOAI
+          embedModel: amazon.titan-embed-text-v2@SOAI
+          reconcileModel: gemma@SOAI
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false
@@ -2727,5 +2739,14 @@ soc:
               enabled: true
               adapter: SOAI
               charsPerTokenEstimate: 4
+            - id: amazon.titan-embed-text-v2
+              displayName: amazon.titan-embed-text-v2
+              origin: USA
+              contextLimitSmall: 8192
+              contextLimitLarge: 8192
+              lowBalanceColorAlert: 500000
+              enabled: true
+              adapter: SOAI
+              charsPerTokenEstimate: 4
               
             

salt/soc/soc_soc.yaml

@@ -845,6 +845,42 @@ soc:
             DetectionEngineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
+          useMemory:
+            description: Enables the Memory system for OnionAI
+            global: True
+          useMemoryScanner:
+            description: Enables the memory scanner for automatic memory extraction from historical sessions.
+            global: True
+          memoryScanIntervalSeconds:
+            description: How long to wait in seconds between attempts to scan sessions for new memories.
+            global: True
+          memoryProximityThreshold:
+            description: Describes how close memories need to be on a floating point scale from 0.0 to 1.0 to be considered when reconciling new memories with old ones. This value is usually higher than messageProximityThreshold.
+            global: True
+          messageProximityThreshold:
+            description: Describes how close a memory needs to be to a user's message on a floating point scale from 0.0 to 1.0 to be included in the context. This value is usually lower than memoryProximityThreshold.
+            global: True
+          maxUserMemoriesToInclude:
+            description: Specify the max number of user-specific memories to include in the prompt when a user sends a message.
+            global: True
+          maxGlobalMemoriesToInclude:
+            description: Specify the max number of global memories to include in the prompt when a user sends a message.
+            global: True
+          maxUserMemoriesToReconcile:
+            description: When reconciling new user-specific memories with existing user-specific memories, this determines how many old memories may be considered.
+            global: True
+          maxGlobalMemoriesToReconcile:
+            description: When reconciling new global memories with existing global memories, this determines how many old memories may be considered.
+            global: True
+          memoryModel:
+            description: The model to use when extracting memories from sessions.
+            global: True
+          embedModel: 
+            description: The model to use when embedding a memory as a vector. Note that only memories embedded using the same model may be compared and only memories created with the model specified here will be considered when informing an agent of existing memories.
+            global: True
+          reconcileModel:
+            description: The model to use when reconciling memories that contain nearly the same content.
+            global: True
       client:
         assistant:
           enabled:

setup/so-setup

@@ -833,7 +833,6 @@ if ! [[ -f $install_opt_file ]]; then
 		check_sos_appliance
 		drop_install_options
 		hypervisor_local_states
-		mark_setup_complete
 		verify_setup
 	fi