Merge pull request #16238 from Security-Onion-Solutions/hotfix/3.3.0

Hotfix/3.3.0
2026-10-06 22:44:48 +02:00 · 2026-09-11 16:38:51 -04:00
113 changed files with 320 additions and 4185 deletions
@@ -13,7 +13,6 @@ body:
        - 3.1.0
        - 3.2.0
        - 3.3.0
-        - 3.4.0
        - Other (please provide detail below)
    validations:
      required: true
@@ -6,9 +6,6 @@ on:
      - "salt/sensoroni/files/analyzers/**"
      - "salt/manager/tools/sbin/**"
      - "salt/_beacons/**"
-      - "salt/telegraf/tools/sbin_jinja/**"
-      - "salt/telegraf/defaults.yaml"
-      - "salt/telegraf/soc_telegraf.yaml"

 jobs:
  build:
@@ -37,25 +34,3 @@ jobs:
    - name: Test with pytest
      run: |
        PYTHONPATH=${{ matrix.python-code-path }} pytest ${{ matrix.python-code-path }} --cov=${{ matrix.python-code-path }} --doctest-modules --cov-report=term --cov-fail-under=100 --cov-config=pytest.ini
-
-  telegraf-collector:
-    # so-container-stats is a jinja template rather than an importable module, so it gets its
-    # own job: the test renders it the way salt does, then drives it with a faked docker engine
-    # and cgroup tree. No container runtime is needed.
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python
-      uses: actions/setup-python@v3
-      with:
-        python-version: "3.14"
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install flake8 pytest jinja2 pyyaml
-    - name: Lint with flake8
-      run: |
-        flake8 salt/telegraf/tools/sbin_jinja/so-container-stats_test.py --config=pytest.ini
-    - name: Test with pytest
-      run: |
-        pytest salt/telegraf/tools/sbin_jinja/so-container-stats_test.py -v
@@ -1 +1 @@
-
+20260911
@@ -1 +1 @@
-3.4.0
+3.3.0
@@ -131,8 +131,6 @@ def beacon(config):  # noqa: C901
            'setting_id': setting_id,
            'node_id': node_id,
        })
-        log.info('postgres_pillar_beacon: audit_settings id=%d setting_id=%s node_id=%s',
-                 row_id, setting_id, node_id)
        if row_id > max_id:
            max_id = row_id

@@ -117,25 +117,14 @@ elastic_curl_config:
 {% endif %}


-# A non-root owner here can chmod the directory and replace any script in it, including
-# the root-owned ones. 555 is the mode the filesystem RPM ships; root ignores it anyway.
-usr_sbin_perms:
-  file.directory:
-    - name: /usr/sbin
-    - user: root
-    - group: root
-    - mode: 555
-
 common_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://common/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755
    - show_changes: False
-    - require:
-      - file: usr_sbin_perms
 {% if GLOBALS.role == 'so-heavynode' %}
    - exclude_pat:
      - so-pcap-import
@@ -170,8 +159,8 @@ common_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://common/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939 
    - file_mode: 755
    - template: jinja
    - show_changes: False
@@ -184,8 +173,6 @@ so-status_script:
  file.managed:
    - name: /usr/sbin/so-status
    - source: salt://common/tools/sbin/so-status
-    - user: root
-    - group: root
    - mode: 755

 {% if GLOBALS.is_sensor %}
@@ -217,11 +204,9 @@ sostatus_log:
    - replace: False

 # Install sostatus check cron. This is used to populate Grid.
-# telegraf reads status.log on the same minute boundary this runs, so write aside and rename
-# rather than truncating the file it is reading
 so-status_check_cron:
  cron.present:
-    - name: '/usr/sbin/so-status -j > /opt/so/log/sostatus/status.log.tmp 2>&1; mv -f /opt/so/log/sostatus/status.log.tmp /opt/so/log/sostatus/status.log'
+    - name: '/usr/sbin/so-status -j > /opt/so/log/sostatus/status.log 2>&1'
    - identifier: so-status_check_cron
    - user: root
    - minute: '*/1'
@@ -18,61 +18,47 @@ copy_so-common_common_tools_sbin:
    - name: /opt/so/saltstack/default/salt/common/tools/sbin/so-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-common
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-image-common_common_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/common/tools/sbin/so-image-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-image-common
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_soup_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/soup
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/soup
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-firewall_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-firewall
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-firewall
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-yaml_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-yaml.py
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-yaml.py
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-repo-sync_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-repo-sync
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-repo-sync
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_bootstrap-salt_manager_tools_sbin:
  file.copy:
    - name: /opt/so/saltstack/default/salt/salt/scripts/bootstrap-salt.sh
    - source: {{UPDATE_DIR}}/salt/salt/scripts/bootstrap-salt.sh
-    - user: root
-    - group: root
-    - mode: 644
+    - preserve: True

 # This section is used to put the new script in place so that it can be called during soup.
 # It is faster than calling the states that normally manage them to put them in place.
@@ -81,60 +67,46 @@ copy_so-common_sbin:
    - name: /usr/sbin/so-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-common
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-image-common_sbin:
  file.copy:
    - name: /usr/sbin/so-image-common
    - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-image-common
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_soup_sbin:
  file.copy:
    - name: /usr/sbin/soup
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/soup
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-firewall_sbin:
  file.copy:
    - name: /usr/sbin/so-firewall
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-firewall
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-yaml_sbin:
  file.copy:
    - name: /usr/sbin/so-yaml.py
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-yaml.py
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_so-repo-sync_sbin:
  file.copy:
    - name: /usr/sbin/so-repo-sync
    - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-repo-sync
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True

 copy_bootstrap-salt_sbin:
  file.copy:
    - name: /usr/sbin/bootstrap-salt.sh
    - source: {{UPDATE_DIR}}/salt/salt/scripts/bootstrap-salt.sh
    - force: True
-    - user: root
-    - group: root
-    - mode: 755
+    - preserve: True
@@ -240,8 +240,7 @@ copy_new_files() {
  cd $UPDATE_DIR
  rsync -a salt $DEFAULT_SALT_DIR/ --delete "${EXCLUDE_ARGS[@]}"
  rsync -a pillar $DEFAULT_SALT_DIR/ --delete "${EXCLUDE_ARGS[@]}"
-  # Root-executed code; SOC only needs to read it. Local dirs stay socore-owned.
-  chown -R root:root $DEFAULT_SALT_DIR/
+  chown -R socore:socore $DEFAULT_SALT_DIR/
  cd /tmp
 }

@@ -9,7 +9,6 @@ import sys
 import subprocess
 import os
 import json
-import tempfile

 sys.path.append('/opt/saltstack/salt/lib/python3.10/site-packages/')
 import salt.config
@@ -18,21 +17,6 @@ import salt.loader
 __opts__ = salt.config.minion_config('/etc/salt/minion')
 __grains__ = salt.loader.grains(__opts__)

-def write_atomic(path, value):
-  # telegraf reads these files on its own schedule; replacing them by rename means it never
-  # reads a truncated file and reports an empty value as if it were real
-  directory = os.path.dirname(path)
-  handle, temp = tempfile.mkstemp(dir=directory)
-  try:
-    with os.fdopen(handle, 'w') as f:
-      f.write(str(value))
-    os.chmod(temp, 0o644)
-    os.replace(temp, path)
-  except Exception:
-    os.path.exists(temp) and os.unlink(temp)
-    raise
-
-
 def check_needs_restarted():
  osfam = __grains__['os_family']
  val = '0'
@@ -50,7 +34,8 @@ def check_needs_restarted():
  else:
    fail("Unsupported OS")

-  write_atomic(outfile, val)
+  with open(outfile, 'w') as f:
+    f.write(val)

 def check_for_fps():
    feat = 'fps'
@@ -71,7 +56,8 @@ def check_for_fps():
          # Unknown, so assume 0
          fps = 0

-    write_atomic('/opt/so/log/sostatus/fps_enabled', fps)
+    with open('/opt/so/log/sostatus/fps_enabled', 'w') as f:
+       f.write(str(fps))

 def check_for_lks():
    feat = 'Lks'
@@ -94,7 +80,8 @@ def check_for_lks():
                                lks = 1
        if lks:
            break
-    write_atomic('/opt/so/log/sostatus/lks_enabled', lks)
+    with open('/opt/so/log/sostatus/lks_enabled', 'w') as f:
+       f.write(str(lks))

 def fail(msg):
  print(msg, file=sys.stderr)
@@ -177,7 +177,6 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Unexpected authorization header" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Missing ory_kratos_session cookie" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Static assets preprocessor only supports GET and HEAD requests" # expected WARN log lines indicating invalid auth header
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|respondError"                 # respondError is a function name, output via http middleware as standard request logging
 fi

 if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
@@ -241,7 +240,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|marked for removal"           # docker container getting recycled
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|tcp 127.0.0.1:6791: bind: address already in use" # so-elastic-fleet agent restarting. Seen starting w/ 8.18.8 https://github.com/elastic/kibana/issues/201459
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-.*user so_kibana lacks the required permissions" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|manifest unknown"             # so-dockerregistry logs a tag lookup miss during image copy; not tied to one docker version
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|manifest unknown"             # appears in so-dockerregistry log for so-tcpreplay following docker upgrade to 29.2.1-1
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Could not index event to Elasticsearch.*\"version\" => \"9.0.8\"" # Expected during Elastic upgrade temporarily, as policies referencing older pipelines are updated
 fi

@@ -8,37 +8,21 @@
 # Elastic License 2.0.


-SENSOR_DIR="${SENSOR_DIR:-/nsm}"
+SENSOR_DIR='/nsm'
 CRIT_DISK_USAGE=90
-LOG="${LOG:-/opt/so/log/sensor_clean.log}"
-LOCK="${LOCK:-/var/tmp/so-sensor-clean.lock}"
-MAX_PASSES=100
+CUR_USAGE=$(df -P $SENSOR_DIR | tail -1 | awk '{print $5}' | tr -d %)
+LOG="/opt/so/log/sensor_clean.log"
+TODAY=$(date -u "+%Y-%m-%d")

-ZEEK_LOGS="$SENSOR_DIR/zeek/logs"
-STRELKA_FILES="$SENSOR_DIR/strelka/processed"
-SURICATA_LOGS="$SENSOR_DIR/suricata"
-PCAPS="$SENSOR_DIR/pcapout"
-
-log() {
-	echo "$(date) - $*" >>"$LOG"
-}
-
-disk_usage() {
-	df -P "$SENSOR_DIR" | tail -1 | awk '{print $5}' | tr -d %
-}
-
-disk_avail() {
-	df -P "$SENSOR_DIR" | tail -1 | awk '{print $4}'
-}
-
-# sets REMOVED=1 if anything was actually deleted
 clean() {
 	## find the oldest Zeek logs directory
-	OLDEST_DIR=$(ls "$ZEEK_LOGS" 2>/dev/null | grep -v "current" | grep -v "stats" | grep -v "packetloss" | grep -v "zeek_clean" | sort | head -n 1)
-	if [ -n "$OLDEST_DIR" ]; then
-		log "Removing directory: $ZEEK_LOGS/$OLDEST_DIR"
-		rm -rf "$ZEEK_LOGS/$OLDEST_DIR"
-		REMOVED=1
+	OLDEST_DIR=$(ls /nsm/zeek/logs/ | grep -v "current" | grep -v "stats" | grep -v "packetloss" | grep -v "zeek_clean" | sort | head -n 1)
+	if [ -z "$OLDEST_DIR" -o "$OLDEST_DIR" == ".." -o "$OLDEST_DIR" == "." ]; then
+		echo "$(date) - No old Zeek logs available to clean up in /nsm/zeek/logs/" >>$LOG
+		#exit 0
+	else
+		echo "$(date) - Removing directory: /nsm/zeek/logs/$OLDEST_DIR" >>$LOG
+		rm -rf /nsm/zeek/logs/"$OLDEST_DIR"
 	fi

 	## Remarking for now, as we are moving extracted files to /nsm/strelka/processed
@@ -59,73 +43,58 @@ clean() {
 	#fi

 	## Clean up Zeek extracted files processed by Strelka
-	OLDEST_STRELKA=$(find "$STRELKA_FILES" -type f -printf '%T+ %p\n' 2>/dev/null | sort -n | head -n 1)
-	if [ -n "$OLDEST_STRELKA" ]; then
+	STRELKA_FILES='/nsm/strelka/processed'
+	OLDEST_STRELKA=$(find $STRELKA_FILES -type f -printf '%T+ %p\n' | sort -n | head -n 1)
+	if [ -z "$OLDEST_STRELKA" -o "$OLDEST_STRELKA" == ".." -o "$OLDEST_STRELKA" == "." ]; then
+		echo "$(date) - No old files available to clean up in $STRELKA_FILES" >>$LOG
+	else
 		OLDEST_STRELKA_DATE=$(echo $OLDEST_STRELKA | awk '{print $1}' | cut -d+ -f1)
-		log "Removing extracted files for $OLDEST_STRELKA_DATE"
-		REMOVED=1
-		find "$STRELKA_FILES" -type f -printf '%T+ %p\n' 2>/dev/null | grep $OLDEST_STRELKA_DATE | awk '{print $2}' | while read FILE; do
-			log "Removing file: $FILE"
+		OLDEST_STRELKA_FILE=$(echo $OLDEST_STRELKA | awk '{print $2}')
+		echo "$(date) - Removing extracted files for $OLDEST_STRELKA_DATE" >>$LOG
+		find $STRELKA_FILES -type f -printf '%T+ %p\n' | grep $OLDEST_STRELKA_DATE | awk '{print $2}' | while read FILE; do
+			echo "$(date) - Removing file: $FILE" >>$LOG
 			rm -f "$FILE"
 		done
 	fi

 	## Clean up Suricata log files
-	OLDEST_SURICATA=$(find "$SURICATA_LOGS" -type f -printf '%T+ %p\n' 2>/dev/null | sort -n | head -n 1)
-	if [ -n "$OLDEST_SURICATA" ]; then
+	SURICATA_LOGS='/nsm/suricata'
+	OLDEST_SURICATA=$(find $SURICATA_LOGS -type f -printf '%T+ %p\n' | sort -n | head -n 1)
+	if [[ -z "$OLDEST_SURICATA" ]] || [[ "$OLDEST_SURICATA" == ".." ]] || [[ "$OLDEST_SURICATA" == "." ]]; then
+		echo "$(date) - No old files available to clean up in $SURICATA_LOGS" >>$LOG
+	else
 		OLDEST_SURICATA_DATE=$(echo $OLDEST_SURICATA | awk '{print $1}' | cut -d+ -f1)
-		log "Removing logs for $OLDEST_SURICATA_DATE"
-		REMOVED=1
-		find "$SURICATA_LOGS" -type f -printf '%T+ %p\n' 2>/dev/null | grep $OLDEST_SURICATA_DATE | awk '{print $2}' | while read FILE; do
-			log "Removing file: $FILE"
+		OLDEST_SURICATA_FILE=$(echo $OLDEST_SURICATA | awk '{print $2}')
+		echo "$(date) - Removing logs for $OLDEST_SURICATA_DATE" >>$LOG
+		find $SURICATA_LOGS -type f -printf '%T+ %p\n' | grep $OLDEST_SURICATA_DATE | awk '{print $2}' | while read FILE; do
+			echo "$(date) - Removing file: $FILE" >>$LOG
 			rm -f "$FILE"
 		done
 	fi

 	## Clean up extracted pcaps
-	OLDEST_PCAP=$(find "$PCAPS" -type f -printf '%T+ %p\n' 2>/dev/null | sort -n | head -n 1)
-	if [ -n "$OLDEST_PCAP" ]; then
+	PCAPS='/nsm/pcapout'
+	OLDEST_PCAP=$(find $PCAPS -type f -printf '%T+ %p\n' | sort -n | head -n 1)
+	if [ -z "$OLDEST_PCAP" -o "$OLDEST_PCAP" == ".." -o "$OLDEST_PCAP" == "." ]; then
+		echo "$(date) - No old files available to clean up in $PCAPS" >>$LOG
+	else
 		OLDEST_PCAP_DATE=$(echo $OLDEST_PCAP | awk '{print $1}' | cut -d+ -f1)
-		log "Removing extracted files for $OLDEST_PCAP_DATE"
-		REMOVED=1
-		find "$PCAPS" -type f -printf '%T+ %p\n' 2>/dev/null | grep $OLDEST_PCAP_DATE | awk '{print $2}' | while read FILE; do
-			log "Removing file: $FILE"
+		OLDEST_PCAP_FILE=$(echo $OLDEST_PCAP | awk '{print $2}')
+		echo "$(date) - Removing extracted files for $OLDEST_PCAP_DATE" >>$LOG
+		find $PCAPS -type f -printf '%T+ %p\n' | grep $OLDEST_PCAP_DATE | awk '{print $2}' | while read FILE; do
+			echo "$(date) - Removing file: $FILE" >>$LOG
 			rm -f "$FILE"
 		done
 	fi
 }

-# Only one instance at a time; the lock is the fd, so it releases on any exit
-exec 9>"$LOCK" || exit 1
-if ! flock -n 9; then
-	log "another so-sensor-clean is already running (lock $LOCK held); exiting"
-	exit 0
+# Check to see if we are already running
+NUM_RUNNING=$(pgrep -cf "/bin/bash /usr/sbin/so-sensor-clean")
+[ "$NUM_RUNNING" -gt 1 ] && echo "$(date) - $NUM_RUNNING sensor clean script processes running...exiting." >>$LOG && exit 0
+
+if [ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ]; then
+	while [ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ]; do
+		clean
+		CUR_USAGE=$(df -P $SENSOR_DIR | tail -1 | awk '{print $5}' | tr -d %)
+	done
 fi
-
-CUR_USAGE=$(disk_usage)
-[ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ] || exit 0
-
-log "$SENSOR_DIR at ${CUR_USAGE}% (threshold ${CRIT_DISK_USAGE}%); starting cleanup"
-
-PASS=0
-while [ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ]; do
-	PASS=$((PASS + 1))
-	if [ "$PASS" -gt "$MAX_PASSES" ]; then
-		log "stopping after $MAX_PASSES passes; $SENSOR_DIR still at ${CUR_USAGE}%"
-		break
-	fi
-
-	REMOVED=0
-	BEFORE=$(disk_avail)
-	clean
-	CUR_USAGE=$(disk_usage)
-
-	if [ "$REMOVED" -eq 0 ]; then
-		log "nothing left to remove in $ZEEK_LOGS, $STRELKA_FILES, $SURICATA_LOGS, $PCAPS; $SENSOR_DIR still at ${CUR_USAGE}% - space is consumed outside of NSM cleanup scope"
-		break
-	fi
-	if [ "$(disk_avail)" -le "$BEFORE" ]; then
-		log "pass $PASS freed no space; $SENSOR_DIR still at ${CUR_USAGE}% - stopping until next run"
-		break
-	fi
-done
@@ -125,6 +125,4 @@ else
  RAIDSTATUS=1
 fi

-# telegraf reads this file; write aside and rename so it never sees a half-written file
-echo "nsmraid=$RAIDSTATUS" > /opt/so/log/raid/status.log.tmp
-mv -f /opt/so/log/raid/status.log.tmp /opt/so/log/raid/status.log
+echo "nsmraid=$RAIDSTATUS" > /opt/so/log/raid/status.log
@@ -1,12 +1,6 @@
 docker:
  range: '172.17.1.0/24'
  gateway: '172.17.1.1'
-  networks:
-    sobridge: {}
-    soauth:
-      range: '172.17.2.0/24'
-      gateway: '172.17.2.1'
-      manager_only: True
  ulimits:
    - name: nofile
      soft: 1048576
@@ -64,18 +58,18 @@ docker:
      ulimits: []
    'so-kratos':
      final_octet: 28
-      networks: ['soauth']
      port_bindings:
        - 0.0.0.0:4433:4433
+        - 0.0.0.0:4434:4434
      custom_bind_mounts: []
      extra_hosts: []
      extra_env: []
      ulimits: []
    'so-hydra':
      final_octet: 30
-      networks: ['soauth']
      port_bindings:
        - 0.0.0.0:4444:4444
+        - 0.0.0.0:4445:4445
      custom_bind_mounts: []
      extra_hosts: []
      extra_env: []
@@ -134,7 +128,6 @@ docker:
      ulimits: []
    'so-soc':
      final_octet: 34
-      networks: ['sobridge', 'soauth']
      port_bindings:
        - 0.0.0.0:9822:9822
      custom_bind_mounts: []
@@ -1,26 +1,8 @@
 {% import_yaml 'docker/defaults.yaml' as DOCKERDEFAULTS %}
 {% set DOCKERMERGED = salt['pillar.get']('docker', DOCKERDEFAULTS.docker, merge=True) %}
-
-{% if DOCKERMERGED.networks.sobridge is not mapping %}
-{%   do DOCKERMERGED.networks.update({'sobridge': {}}) %}
-{% endif %}
-{% do DOCKERMERGED.networks['sobridge'].update({'range': DOCKERMERGED.range, 'gateway': DOCKERMERGED.gateway}) %}
-
-{% for netname, net in DOCKERMERGED.networks.items() %}
-{%   set RANGESPLIT = net.range.split('.') %}
-{%   do net.update({'prefix': RANGESPLIT[0] ~ '.' ~ RANGESPLIT[1] ~ '.' ~ RANGESPLIT[2] ~ '.'}) %}
-{% endfor %}
+{% set RANGESPLIT = DOCKERMERGED.range.split('.') %}
+{% set FIRSTTHREE = RANGESPLIT[0] ~ '.' ~ RANGESPLIT[1] ~ '.' ~ RANGESPLIT[2] ~ '.' %}

 {% for container, vals in DOCKERMERGED.containers.items() %}
-{%   set CONTAINER_NETS = vals.get('networks', ['sobridge']) %}
-{%   set IPS = {} %}
-{%   for netname in CONTAINER_NETS %}
-{%     do IPS.update({netname: DOCKERMERGED.networks[netname].prefix ~ vals.final_octet}) %}
-{%   endfor %}
-{%   do DOCKERMERGED.containers[container].update({
-         'networks': CONTAINER_NETS,
-         'ips': IPS,
-         'network': CONTAINER_NETS[0],
-         'ip': IPS[CONTAINER_NETS[0]]
-       }) %}
+{%   do DOCKERMERGED.containers[container].update({'ip': FIRSTTHREE ~ DOCKERMERGED.containers[container].final_octet}) %}
 {% endfor %}
@@ -18,10 +18,10 @@ dockergroup:
 dockerheldpackages:
  pkg.installed:
    - pkgs:
-      - containerd.io: 2.3.6-1.el9
-      - docker-ce: 3:29.8.1-1.el9
-      - docker-ce-cli: 1:29.8.1-1.el9
-      - docker-ce-rootless-extras: 29.8.1-1.el9
+      - containerd.io: 2.2.1-1.el9
+      - docker-ce: 3:29.2.1-1.el9
+      - docker-ce-cli: 1:29.2.1-1.el9
+      - docker-ce-rootless-extras: 29.2.1-1.el9
    - hold: True
    - update_holds: True

@@ -71,19 +71,15 @@ dockerreserveports:
    - source: salt://common/files/99-reserved-ports.conf
    - name: /etc/sysctl.d/99-reserved-ports.conf

-{% for NETNAME, NETWORK in DOCKERMERGED.networks.items() %}
-{% if not NETWORK.get('manager_only') or GLOBALS.get('is_manager', False) %}
-sos_docker_net_{{ NETNAME }}:
+sos_docker_net:
  docker_network.present:
-    - name: {{ NETNAME }}
-    - subnet: {{ NETWORK.range }}
-    - gateway: {{ NETWORK.gateway }}
+    - name: sobridge
+    - subnet: {{ DOCKERMERGED.range }}
+    - gateway: {{ DOCKERMERGED.gateway }}
    - options:
-        com.docker.network.bridge.name: '{{ NETNAME }}'
+        com.docker.network.bridge.name: 'sobridge'
        com.docker.network.driver.mtu: '1500'
        com.docker.network.bridge.enable_ip_masquerade: 'true'
        com.docker.network.bridge.enable_icc: 'true'
        com.docker.network.bridge.host_binding_ipv4: '0.0.0.0'
-    - unless: ip l | grep {{ NETNAME }}
-{% endif %}
-{% endfor %}
+    - unless: ip l | grep sobridge
@@ -7,40 +7,6 @@ docker:
    description: Default docker IP range for containers.
    helpLink: docker
    advanced: True
-  networks:
-    sobridge:
-      description: |
-        The default docker network, carrying most containers. Its range and gateway are taken
-        from the docker.range and docker.gateway settings above rather than set here.
-      helpLink: docker
-      readonly: True
-      advanced: True
-      global: True
-    soauth:
-      range:
-        description: |
-          IP range for the soauth docker network, an isolated network for the authentication
-          services, so that the Kratos and Hydra admin APIs are only reachable from the
-          containers placed on it.
-        helpLink: docker
-        readonly: True
-        advanced: True
-        global: True
-      gateway:
-        description: Gateway for the soauth docker network.
-        helpLink: docker
-        readonly: True
-        advanced: True
-        global: True
-      manager_only:
-        description: |
-          Limits the soauth network to grid members running the authentication containers,
-          instead of creating it on every node.
-        helpLink: docker
-        readonly: True
-        advanced: True
-        global: True
-        forcedType: bool
  ulimits:
    description: |
      Default ulimit settings applied to all containers via the Docker daemon. Each entry specifies a resource name (e.g. nofile, memlock, core, nproc) with soft and hard limits. Individual container ulimits override these defaults. Valid resource names include: cpu, fsize, data, stack, core, rss, nproc, nofile, memlock, as, locks, sigpending, msgqueue, nice, rtprio, rttime.
@@ -68,16 +34,6 @@ docker:
        readonly: True
        advanced: True
        global: True
-      networks:
-        description: |
-          Docker networks this container is attached to. The first entry is the container's
-          primary network and determines the address its published ports are forwarded to.
-          Defaults to sobridge when unset.
-        helpLink: docker
-        readonly: True
-        advanced: True
-        global: True
-        forcedType: "[]string"
      port_bindings:
        description: List of port bindings for the container.
        helpLink: docker
@@ -21,7 +21,6 @@ elastalert:
    - gid: 933
    - home: /opt/so/conf/elastalert
    - createhome: False
-    - shell: /sbin/nologin

 elastalogdir:
  file.directory:
@@ -34,8 +33,8 @@ elastalert_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elastalert/tools/sbin
-    - user: root
-    - group: root
+    - user: 933
+    - group: 939
    - file_mode: 755

 #elastalert_sbin_jinja:
@@ -19,7 +19,6 @@ elastic-agent-pr:
    - gid: 948
    - home: /opt/so/conf/elastic-fleet-pr
    - createhome: False
-    - shell: /sbin/nologin

 {% else %}

@@ -20,7 +20,6 @@ elastic-agent:
    - gid: 949
    - home: /opt/so/conf/elastic-agent
    - createhome: False
-    - shell: /sbin/nologin

 elasticagentconfdir:
  file.directory:
@@ -40,8 +39,8 @@ elasticagent_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticagent/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 949
+    - group: 939
    - file_mode: 755
    - template: jinja

@@ -26,14 +26,13 @@ elastic-fleet:
    - gid: 947
    - home: /opt/so/conf/elastic-fleet
    - createhome: False
-    - shell: /sbin/nologin

 elasticfleet_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticfleet/tools/sbin
-    - user: root
-    - group: root
+    - user: 947
+    - group: 939
    - file_mode: 755
    - show_changes: False

@@ -41,8 +40,8 @@ elasticfleet_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticfleet/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 947
+    - group: 939 
    - file_mode: 755
    - template: jinja
    - exclude_pat:
@@ -82,8 +81,8 @@ eapackageupgrade:
  file.managed:
    - name: /usr/sbin/so-elastic-fleet-package-upgrade
    - source: salt://elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade
-    - user: root
-    - group: root
+    - user: 947
+    - group: 939
    - mode: 755
    - template: jinja

@@ -29,7 +29,7 @@
              "\\.gz$"
            ],
            "include_files": [],
-            "processors": "- dissect:\n    tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n    field: \"log.file.path\"\n    target_prefix: \"\"\n- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n- add_fields:\n    target: event\n    fields:\n      dataset: windows.forwarded\n      module: windows\n      imported: true\n- add_fields:\n    target: \"@metadata\"\n    fields:\n        pipeline: import.evtx\n- if:\n    equals:\n      winlog.channel: 'Security'\n  then: \n    - add_fields:\n        target: event\n        fields:\n          dataset: system.security\n          module: system\n- if:\n    equals:\n      winlog.channel: 'Windows PowerShell'\n  then: \n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.powershell\n          module: windows\n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n  then: \n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.sysmon_operational\n          module: windows\n          imported: true\n- if:\n    equals:\n      winlog.channel: 'Application'\n  then: \n    - add_fields:\n        target: event\n        fields:\n          dataset: system.application\n          module: system\n- if:\n    equals:\n      winlog.channel: 'System'\n  then: \n    - add_fields:\n        target: event\n        fields:\n          dataset: system.system\n          module: system\n    \n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n  then: \n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.powershell_operational\n          module: windows\n- add_fields:\n    target: data_stream\n    fields:\n        type: logs\n        dataset: import",
+            "processors": "- dissect:\n    tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n    field: \"log.file.path\"\n    target_prefix: \"\"\n- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n- drop_fields:\n    fields: [\"host\"]\n    ignore_missing: true\n- add_fields:\n    target: data_stream\n    fields:\n      type: logs\n      dataset: system.security\n- add_fields:\n    target: event\n    fields:\n      dataset: system.security\n      module: system\n      imported: true\n- add_fields:\n    target: \"@metadata\"\n    fields:\n        pipeline: logs-system.security-2.22.3\n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.sysmon_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.sysmon_operational\n          module: windows\n          imported: true\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.sysmon_operational-3.9.0\n- if:\n    equals:\n      winlog.channel: 'Application'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.application-2.22.3\n- if:\n    equals:\n      winlog.channel: 'System'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.system-2.22.3\n    \n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.powershell_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.powershell_operational\n          module: windows\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.powershell_operational-3.9.0\n- add_fields:\n    target: data_stream\n    fields:\n        dataset: import",
            "tags": [
              "import"
            ],
@@ -14,8 +14,8 @@ so-elastic-agent-install:
  file.managed:
    - name: /usr/sbin/so-elastic-agent-install
    - source: salt://elasticfleet/tools/sbin/so-elastic-agent-install
-    - user: root
-    - group: root
+    - user: 947
+    - group: 939
    - mode: 755
    - show_changes: False

@@ -30,14 +30,17 @@
    'azure_metrics.monitor': 'azure.monitor',
    'azure_metrics.storage_account': 'azure.storage_account',
    'azure_openai.metrics': 'azure.open_ai',
+    'beat.state': 'beats.stack_monitoring.state',
+    'beat.stats': 'beats.stack_monitoring.stats',
+    'enterprisesearch.health': 'enterprisesearch.stack_monitoring.health',
+    'enterprisesearch.stats': 'enterprisesearch.stack_monitoring.stats',
    'kibana.cluster_actions': 'kibana.stack_monitoring.cluster_actions',
    'kibana.cluster_rules': 'kibana.stack_monitoring.cluster_rules',
    'kibana.node_actions': 'kibana.stack_monitoring.node_actions',
    'kibana.node_rules': 'kibana.stack_monitoring.node_rules',
    'kibana.stats': 'kibana.stack_monitoring.stats',
    'kibana.status': 'kibana.stack_monitoring.status',
-    'logstash.node': 'logstash.stack_monitoring.node',
-    'logstash.node_cel': 'logstash.node',
+    'logstash.node_cel': 'logstash.stack_monitoring.node',
    'logstash.node_stats': 'logstash.stack_monitoring.node_stats',
    'synthetics.browser': 'synthetics-browser',
    'synthetics.browser_network': 'synthetics-browser.network',
@@ -30,56 +30,6 @@ fleet_api() {
    curl -sK /opt/so/conf/elasticsearch/curl.config -L "localhost:5601/api/fleet/${QUERYPATH}" "$@" --retry 3 --retry-delay 10 --fail 2>/dev/null
 }

-elastic_fleet_require_agent_policy() {
-    local AGENT_POLICY=$1
-    local POLICY_JSON
-
-    if ! POLICY_JSON=$(fleet_api "agent_policies/$AGENT_POLICY") || [ -z "$POLICY_JSON" ]; then
-        echo "Error: Agent policy '$AGENT_POLICY' was not found or is not visible in the current Kibana space." >&2
-        return 1
-    fi
-
-    if ! jq -e '.item.package_policies | type == "array"' <<<"$POLICY_JSON" >/dev/null 2>&1; then
-        echo "Error: Agent policy '$AGENT_POLICY' was not found or is not visible in the current Kibana space." >&2
-        return 1
-    fi
-
-    echo "$POLICY_JSON"
-}
-
-# Print the single active enrollment token for POLICY_ID.
-# Exit 1: retryable (API failure, invalid response, no active token)
-# Exit 2: multiple active tokens - Shouldn't get into this state without manual intervention
-elastic_fleet_active_enrollment_token() {
-    local POLICY_ID=$1
-    local RESP TOKEN_COUNT API_KEY
-
-    if ! RESP=$(fleet_api "enrollment_api_keys?perPage=100" -H 'kbn-xsrf: true' -H 'Content-Type: application/json'); then
-        echo "Error: Failed to retrieve enrollment tokens for agent policy '$POLICY_ID'." >&2
-        return 1
-    fi
-
-    if ! jq -e '.list' <<<"$RESP" >/dev/null 2>&1; then
-        echo "Error: Invalid enrollment token response for agent policy '$POLICY_ID'." >&2
-        return 1
-    fi
-
-    TOKEN_COUNT=$(jq --arg pid "$POLICY_ID" '[.list[] | select(.policy_id == $pid and .active == true)] | length' <<<"$RESP")
-
-    if [ "${TOKEN_COUNT:-0}" -eq 0 ]; then
-        echo "Error: No active enrollment token found for agent policy '$POLICY_ID'." >&2
-        return 1
-    fi
-
-    if [ "$TOKEN_COUNT" -gt 1 ]; then
-        echo "Error: Found $TOKEN_COUNT active enrollment tokens for agent policy '$POLICY_ID'; expected exactly one." >&2
-        return 2
-    fi
-
-    API_KEY=$(jq -r --arg pid "$POLICY_ID" '.list[] | select(.policy_id == $pid and .active == true) | .api_key' <<<"$RESP")
-    echo "$API_KEY"
-}
-
 # Max number of concurrent Fleet write jobs (create/update). Override via env if needed.
 MAX_FLEET_JOBS=${MAX_FLEET_JOBS:-10}

@@ -112,7 +62,15 @@ elastic_fleet_load_integrations_dir() {
    i=0

    # Fetch the agent policy a single time; we look up integration ids locally below.
-    if ! POLICY_JSON=$(elastic_fleet_require_agent_policy "$AGENT_POLICY"); then
+    if ! POLICY_JSON=$(fleet_api "agent_policies/$AGENT_POLICY"); then
+        echo "Error: Failed to retrieve agent policy '$AGENT_POLICY'."
+        rm -f "$FAIL_FILE"
+        rm -rf "$OUT_DIR"
+        return 1
+    fi
+
+    if ! jq -e '.item.package_policies' <<<"$POLICY_JSON" >/dev/null 2>&1; then
+        echo "Error: Invalid agent policy response for '$AGENT_POLICY'."
        rm -f "$FAIL_FILE"
        rm -rf "$OUT_DIR"
        return 1
@@ -166,15 +124,9 @@ elastic_fleet_integration_check() {

    JSON_STRING=$2

-    NAME=$(jq -r .name "$JSON_STRING")
-    INTEGRATION_ID=""
+    NAME=$(jq -r .name $JSON_STRING)

-    local POLICY_JSON
-    if ! POLICY_JSON=$(elastic_fleet_require_agent_policy "$AGENT_POLICY"); then
-        return 1
-    fi
-
-    INTEGRATION_ID=$(jq -r --arg n "$NAME" '.item.package_policies[]? | select(.name==$n) | .id' <<<"$POLICY_JSON")
+    INTEGRATION_ID=$(/usr/sbin/so-elastic-fleet-agent-policy-view "$AGENT_POLICY" | jq -r '.item.package_policies[] | select(.name=="'"$NAME"'") | .id')

 }

@@ -196,16 +148,7 @@ elastic_fleet_integration_remove() {

    NAME=$2

-    local POLICY_JSON
-    if ! POLICY_JSON=$(elastic_fleet_require_agent_policy "$AGENT_POLICY"); then
-        return 1
-    fi
-
-    INTEGRATION_ID=$(jq -r --arg n "$NAME" '.item.package_policies[]? | select(.name==$n) | .id' <<<"$POLICY_JSON")
-    if [ -z "$INTEGRATION_ID" ]; then
-        echo "Error: Integration '$NAME' was not found in agent policy '$AGENT_POLICY'." >&2
-        return 1
-    fi
+    INTEGRATION_ID=$(/usr/sbin/so-elastic-fleet-agent-policy-view "$AGENT_POLICY" | jq -r '.item.package_policies[] | select(.name=="'"$NAME"'") | .id')

    JSON_STRING=$( jq -n \
                    --arg INTEGRATIONID "$INTEGRATION_ID" \
@@ -13,10 +13,7 @@ ERROR=false
 for INTEGRATION in /opt/so/conf/elastic-fleet/integrations/elastic-defend/*.json
 do
  printf "\n\nInitial Endpoints Policy - Loading $INTEGRATION\n"
-  if ! elastic_fleet_integration_check "endpoints-initial" "$INTEGRATION"; then
-    ERROR=true
-    continue
-  fi
+  elastic_fleet_integration_check "endpoints-initial" "$INTEGRATION"
  if [ -n "$INTEGRATION_ID" ]; then
      printf "\n\nIntegration $NAME exists - Upgrading integration policy\n"
      if ! elastic_fleet_integration_policy_upgrade "$INTEGRATION_ID"; then
@@ -7,35 +7,20 @@
 . /usr/sbin/so-elastic-fleet-common

 # Get all the fleet policies
-if ! json_output=$(fleet_api "agent_policies" -H 'kbn-xsrf: true'); then
-    echo "Error: Failed to retrieve Fleet agent policies." >&2
-    exit 1
-fi
-
-if ! jq -e '.items' <<<"$json_output" >/dev/null 2>&1; then
-    echo "Error: Invalid Fleet agent policies response." >&2
-    exit 1
-fi
+json_output=$(curl -s -K /opt/so/conf/elasticsearch/curl.config -L -X GET "localhost:5601/api/fleet/agent_policies" -H 'kbn-xsrf: true')

 # Extract the IDs that start with "FleetServer_"
-POLICY=$(jq -r '.items[] | select(.id | startswith("FleetServer_")) | .id' <<<"$json_output")
+POLICY=$(echo "$json_output" | jq -r '.items[] | select(.id | startswith("FleetServer_")) | .id')

 # Iterate over each ID in the POLICY variable
 for POLICYNAME in $POLICY; do
    printf "\nUpdating Policy: $POLICYNAME\n"

-    if ! POLICY_JSON=$(elastic_fleet_require_agent_policy "$POLICYNAME"); then
-        exit 1
-    fi
-
-    INTEGRATION_ID=$(jq -r '.item.package_policies[]? | select(.package.name == "fleet_server") | .id' <<<"$POLICY_JSON")
-    if [ -z "$INTEGRATION_ID" ]; then
-        echo "Error: fleet_server integration was not found in agent policy '$POLICYNAME'." >&2
-        exit 1
-    fi
+    # First get the Integration ID
+    INTEGRATION_ID=$(/usr/sbin/so-elastic-fleet-agent-policy-view "$POLICYNAME" | jq -r '.item.package_policies[] | select(.package.name == "fleet_server") | .id')  

    # Modify the default integration policy to update the policy_id and an with the correct naming
-    UPDATED_INTEGRATION_POLICY=$(jq --arg policy_id "$POLICYNAME" --arg name "fleet_server-$POLICYNAME" '
+	UPDATED_INTEGRATION_POLICY=$(jq --arg policy_id "$POLICYNAME" --arg name "fleet_server-$POLICYNAME" '
    .policy_id = $policy_id |
    .name = $name' /opt/so/conf/elastic-fleet/integrations/fleet-server/fleet-server.json)

@@ -22,19 +22,12 @@ NUM_RUNNING=$(pgrep -cf "/bin/bash /sbin/so-elastic-agent-gen-installers")

 for i in {1..30}
 do
-   ENROLLMENTOKEN=$(elastic_fleet_active_enrollment_token "endpoints-initial")
-   TOKEN_RC=$?
-   if [ "$TOKEN_RC" -eq 2 ]; then
-     exit 1
-   fi
+   ENROLLMENTOKEN=$(curl -K /opt/so/conf/elasticsearch/curl.config -L "localhost:5601/api/fleet/enrollment_api_keys?perPage=100" -H 'kbn-xsrf: true' -H 'Content-Type: application/json'  | jq .list | jq -r -c '.[] | select(.policy_id | contains("endpoints-initial")) | .api_key')
   FLEETHOST=$(curl -K /opt/so/conf/elasticsearch/curl.config 'http://localhost:5601/api/fleet/fleet_server_hosts/grid-default' | jq -r  '.item.host_urls[]' | paste -sd ',')
-   if [[ -n "$FLEETHOST" ]] && [[ -n "$ENROLLMENTOKEN" ]]; then
-     break
-   fi
-   sleep 10
+if [[ $FLEETHOST ]] && [[  $ENROLLMENTOKEN ]]; then break; else sleep 10; fi
 done

-if [[ -z "$FLEETHOST" ]] || [[ -z "$ENROLLMENTOKEN" ]]; then
+if [[ -z $FLEETHOST ]] || [[ -z $ENROLLMENTOKEN ]]; then 
  printf "\nFleet Host URL, Enrollment Token or Elastic Version empty - exiting..."
  printf "\nFleet Host: $FLEETHOST, Enrollment Token: $ENROLLMENTOKEN\n"
  exit 1
@@ -74,25 +67,19 @@ for GOOS in "${GOTARGETOS[@]}"; do
    GOARCH="amd64"
    if [[ $GOOS == 'darwin/arm64' ]]; then GOOS="darwin" && GOARCH="arm64"; fi
    printf "\n\n### Generating $GOOS/$GOARCH Installer...\n"
-    if ! docker run -e CGO_ENABLED=0 -e GOOS=$GOOS -e GOARCH=$GOARCH \
+    docker run -e CGO_ENABLED=0 -e GOOS=$GOOS -e GOARCH=$GOARCH \
    --mount type=bind,source=/etc/pki/tls/certs/,target=/workspace/files/cert/ \
    --mount type=bind,source=/nsm/elastic-agent-workspace/,target=/workspace/files/elastic-agent/ \
    --mount type=bind,source=/opt/so/saltstack/local/salt/elasticfleet/files/,target=/output/ \
-    {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent-builder:{{ GLOBALS.so_version }} go build -ldflags "-X main.fleetHostURLsList=$FLEETHOST -X main.enrollmentToken=$ENROLLMENTOKEN"  -o /output/so-elastic-agent_${GOOS}_${GOARCH}; then
-        printf "\n### ERROR: Failed to generate $GOOS/$GOARCH installer. Exiting...\n"
-        exit 1
-    fi
+    {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent-builder:{{ GLOBALS.so_version }} go build -ldflags "-X main.fleetHostURLsList=$FLEETHOST -X main.enrollmentToken=$ENROLLMENTOKEN"  -o /output/so-elastic-agent_${GOOS}_${GOARCH}
    printf "\n### $GOOS/$GOARCH Installer Generated...\n"
 done

 printf "\n\n### Generating MSI...\n"
 cp /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_windows_amd64 /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_windows_amd64.exe
-if ! docker run \
+docker run \
 --mount type=bind,source=/opt/so/saltstack/local/salt/elasticfleet/files/,target=/output/ -w /output \
-{{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent-builder:{{ GLOBALS.so_version }} wixl -o so-elastic-agent_windows_amd64_msi --arch x64 /workspace/so-elastic-agent.wxs; then
-    printf "\n### ERROR: Failed to generate MSI. Exiting...\n"
-    exit 1
-fi
+{{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent-builder:{{ GLOBALS.so_version }} wixl -o so-elastic-agent_windows_amd64_msi --arch x64 /workspace/so-elastic-agent.wxs
 printf "\n### MSI Generated...\n"

 # Verify installers were created
@@ -202,9 +202,26 @@ fi
 ### Finalization ###

 # Query for Enrollment Tokens for default policies
-ENDPOINTSENROLLMENTOKEN=$(elastic_fleet_active_enrollment_token "endpoints-initial") || exit 1
-GRIDNODESENROLLMENTOKENGENERAL=$(elastic_fleet_active_enrollment_token "so-grid-nodes_general") || exit 1
-GRIDNODESENROLLMENTOKENHEAVY=$(elastic_fleet_active_enrollment_token "so-grid-nodes_heavy") || exit 1
+if ENDPOINTSENROLLMENTOKEN_RAW=$(fleet_api "enrollment_api_keys" -H 'kbn-xsrf: true' -H 'Content-Type: application/json'); then
+    ENDPOINTSENROLLMENTOKEN=$(echo "$ENDPOINTSENROLLMENTOKEN_RAW" | jq .list | jq -r -c '.[] | select(.policy_id | contains("endpoints-initial")) | .api_key')
+else
+    echo -e "\nFailed to query for Endpoints enrollment token"
+    exit 1
+fi
+
+if GRIDNODESENROLLMENTOKENGENERAL_RAW=$(fleet_api "enrollment_api_keys" -H 'kbn-xsrf: true' -H 'Content-Type: application/json'); then
+    GRIDNODESENROLLMENTOKENGENERAL=$(echo "$GRIDNODESENROLLMENTOKENGENERAL_RAW" | jq .list | jq -r -c '.[] | select(.policy_id | contains("so-grid-nodes_general")) | .api_key')
+else
+    echo -e "\nFailed to query for Grid nodes - General enrollment token"
+    exit 1
+fi
+
+if GRIDNODESENROLLMENTOKENHEAVY_RAW=$(fleet_api "enrollment_api_keys" -H 'kbn-xsrf: true' -H 'Content-Type: application/json'); then
+    GRIDNODESENROLLMENTOKENHEAVY=$(echo "$GRIDNODESENROLLMENTOKENHEAVY_RAW" | jq .list | jq -r -c '.[] | select(.policy_id | contains("so-grid-nodes_heavy")) | .api_key')
+else
+    echo -e "\nFailed to query for Grid nodes - Heavy enrollment token"
+    exit 1
+fi

 # Store needed data in minion pillar
 pillar_file=/opt/so/saltstack/local/pillar/minions/{{ GLOBALS.minion_id }}.sls
@@ -32,14 +32,13 @@ elasticsearch:
    - gid: 930
    - home: /opt/so/conf/elasticsearch
    - createhome: False
-    - shell: /sbin/nologin

 elasticsearch_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticsearch/tools/sbin
-    - user: root
-    - group: root
+    - user: 930
+    - group: 939
    - file_mode: 755
    - exclude_pat:
      - so-elasticsearch-pipelines # exclude this because we need to watch it for changes, we sync it in another state
@@ -50,8 +49,8 @@ so-elasticsearch-system-indices-patch-script:
  file.managed:
    - name: /usr/sbin/so-elasticsearch-system-indices-patch
    - source: salt://elasticsearch/tools/sbin/so-elasticsearch-system-indices-patch
-    - user: root
-    - group: root
+    - user: 930
+    - group: 939
    - mode: 755
    - show_changes: False

@@ -59,8 +58,8 @@ elasticsearch_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://elasticsearch/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939 
    - file_mode: 755
    - template: jinja
    - exclude_pat:
@@ -73,8 +72,8 @@ so-elasticsearch-ilm-policy-load-script:
  file.managed:
    - name: /usr/sbin/so-elasticsearch-ilm-policy-load
    - source: salt://elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load
-    - user: root
-    - group: root
+    - user: 930
+    - group: 939
    - mode: 754
    - template: jinja
    - defaults:
@@ -85,8 +84,8 @@ so-elasticsearch-pipelines-script:
  file.managed:
    - name: /usr/sbin/so-elasticsearch-pipelines
    - source: salt://elasticsearch/tools/sbin/so-elasticsearch-pipelines
-    - user: root
-    - group: root
+    - user: 930
+    - group: 939
    - mode: 754
    - show_changes: False

@@ -3309,7 +3309,6 @@ elasticsearch:
        composed_of:
        - event-mappings
        - logs-system.security@package
-        - so-fleet_system.security_caseless-1
        - logs-system.security@custom
        - so-fleet_integrations.ip_mappings-1
        - so-fleet_globals-1
@@ -4176,7 +4175,6 @@ elasticsearch:
      index_template:
        composed_of:
        - logs-windows.forwarded@package
-        - so-fleet_process_caseless-1
        - logs-windows.forwarded@custom
        - so-fleet_integrations.ip_mappings-1
        - so-fleet_globals-1
@@ -4226,7 +4224,6 @@ elasticsearch:
      index_template:
        composed_of:
        - logs-windows.powershell@package
-        - so-fleet_process_caseless-1
        - logs-windows.powershell@custom
        - so-fleet_integrations.ip_mappings-1
        - so-fleet_globals-1
@@ -4276,7 +4273,6 @@ elasticsearch:
      index_template:
        composed_of:
        - logs-windows.powershell_operational@package
-        - so-fleet_process_caseless-1
        - logs-windows.powershell_operational@custom
        - so-fleet_integrations.ip_mappings-1
        - so-fleet_globals-1
@@ -4326,7 +4322,6 @@ elasticsearch:
      index_template:
        composed_of:
        - logs-windows.sysmon_operational@package
-        - so-fleet_process_caseless-1
        - logs-windows.sysmon_operational@custom
        - so-fleet_integrations.ip_mappings-1
        - so-fleet_globals-1
@@ -99,7 +99,7 @@
        },
        {
            "set": {
-                "if": "ctx.tags != null && ctx.tags.contains('import') && ctx._index != null && ctx._index.startsWith('logs-import-')",
+                "if": "ctx.tags != null && ctx.tags.contains('import')",
                "override": true,
                "field": "data_stream.dataset",
                "value": "import"
@@ -107,7 +107,7 @@
        },
        {
            "set": {
-                "if": "ctx.tags != null && ctx.tags.contains('import') && ctx._index != null && ctx._index.startsWith('logs-import-')",
+                "if": "ctx.tags != null && ctx.tags.contains('import')",
                "override": true,
                "field": "data_stream.namespace",
                "value": "so"
@@ -1,31 +0,0 @@
-{
-  "description" : "import.evtx: normalize imported EVTX and reroute to logs-<dataset>-import",
-  "processors" : [
-    { "script":  {
-        "description": "Host from the event, not the importing node",
-        "lang": "painless",
-        "source": "Map host = ['os': ['type': 'windows', 'family': 'windows', 'platform': 'windows']]; def cn = ctx.winlog?.computer_name; if (cn != null && cn.toString().length() > 0) { String name = cn.toString(); int dot = name.indexOf('.'); if (dot > 0) { name = name.substring(0, dot); } host.put('hostname', name); host.put('name', name.toLowerCase()); } ctx.host = host;"
-    } },
-    { "script":  {
-        "description": "String event IDs, as Winlogbeat sends",
-        "lang": "painless",
-        "source": "if (ctx.winlog?.event_id != null) { ctx.winlog.event_id = ctx.winlog.event_id.toString(); } if (ctx.event?.code != null) { ctx.event.code = ctx.event.code.toString(); }"
-    } },
-    { "script":  {
-        "description": "Unnamed <Data> to param1..N, as Winlogbeat",
-        "lang": "painless",
-        "if": "ctx.winlog?.event_data?.Data instanceof Map && ctx.winlog.event_data.Data['#text'] != null",
-        "source": "def t = ctx.winlog.event_data.Data['#text']; List vals = t instanceof List ? t : [t]; for (int i = 0; i < vals.size(); i++) { ctx.winlog.event_data['param' + (i + 1)] = vals.get(i); } ctx.winlog.event_data.remove('Data');"
-    } },
-    { "script":  {
-        "description": "String values and LF line endings, as Winlogbeat",
-        "lang": "painless",
-        "if": "ctx.winlog?.event_data instanceof Map || ctx.winlog?.user_data instanceof Map",
-        "source": "String lf = String.valueOf((char) 10); String crlf = String.valueOf((char) 13) + lf; for (def key : ['event_data', 'user_data']) { def m = ctx.winlog[key]; if (!(m instanceof Map)) { continue; } for (def e : m.entrySet()) { def v = e.getValue(); if (v instanceof String) { e.setValue(v.replace(crlf, lf)); } else if (v instanceof Number || v instanceof Boolean) { e.setValue(v.toString()); } } }"
-    } },
-    { "set":     { "description": "event.kind, as Winlogbeat", "field": "event.kind", "value": "event", "override": false } },
-    { "set":     { "field": "data_stream.dataset", "copy_from": "event.dataset", "override": true, "ignore_empty_value": true } },
-    { "set":     { "field": "data_stream.namespace", "value": "import", "override": true } },
-    { "reroute": { "dataset": "{{data_stream.dataset}}", "namespace": "{{data_stream.namespace}}" } }
-  ]
-}
@@ -5,8 +5,7 @@
    { "rename": 	{ "field": "message2.proto", 			"target_field": "network.transport",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fileinfo.filename", 	"target_field": "file.name",		"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.fileinfo.gaps", 		"target_field": "suricata.fileinfo.gaps",	"ignore_missing": true 	} },
-    { "set":		{ "if": "ctx.suricata?.fileinfo?.gaps == false", 	"field": "file.bytes.missing",	"value": 0 		} },
+    { "rename": 	{ "field": "message2.fileinfo.gaps", 		"target_field": "file.bytes.missing",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fileinfo.magic", 		"target_field": "file.mime_type",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fileinfo.md5", 		"target_field": "hash.md5",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fileinfo.sha1", 		"target_field": "hash.sha1",		"ignore_missing": true 	} },
@@ -1,123 +0,0 @@
-{
-  "_meta": {
-    "managed_by": "security_onion",
-    "managed": true,
-    "description": "Adds .caseless for Lucene queries. Restates each field's package type and .text."
-  },
-  "template": {
-    "mappings": {
-      "properties": {
-        "process": {
-          "properties": {
-            "executable": {
-              "type": "keyword",
-              "ignore_above": 1024,
-              "fields": {
-                "caseless": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "normalizer": "lowercase"
-                },
-                "text": {
-                  "type": "match_only_text"
-                }
-              }
-            },
-            "name": {
-              "type": "keyword",
-              "ignore_above": 1024,
-              "fields": {
-                "caseless": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "normalizer": "lowercase"
-                },
-                "text": {
-                  "type": "match_only_text"
-                }
-              }
-            },
-            "command_line": {
-              "type": "wildcard",
-              "ignore_above": 1024,
-              "fields": {
-                "caseless": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "normalizer": "lowercase"
-                },
-                "text": {
-                  "type": "match_only_text"
-                }
-              }
-            },
-            "parent": {
-              "properties": {
-                "executable": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "fields": {
-                    "caseless": {
-                      "type": "keyword",
-                      "ignore_above": 1024,
-                      "normalizer": "lowercase"
-                    },
-                    "text": {
-                      "type": "match_only_text"
-                    }
-                  }
-                },
-                "name": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "fields": {
-                    "caseless": {
-                      "type": "keyword",
-                      "ignore_above": 1024,
-                      "normalizer": "lowercase"
-                    },
-                    "text": {
-                      "type": "match_only_text"
-                    }
-                  }
-                },
-                "command_line": {
-                  "type": "wildcard",
-                  "ignore_above": 1024,
-                  "fields": {
-                    "caseless": {
-                      "type": "keyword",
-                      "ignore_above": 1024,
-                      "normalizer": "lowercase"
-                    },
-                    "text": {
-                      "type": "match_only_text"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "file": {
-          "properties": {
-            "path": {
-              "type": "keyword",
-              "ignore_above": 1024,
-              "fields": {
-                "caseless": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "normalizer": "lowercase"
-                },
-                "text": {
-                  "type": "match_only_text"
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}
@@ -1,80 +0,0 @@
-{
-  "_meta": {
-    "managed_by": "security_onion",
-    "managed": true,
-    "description": "Adds .caseless for Lucene queries. Keeps each field's existing keyword type."
-  },
-  "template": {
-    "mappings": {
-      "properties": {
-        "process": {
-          "properties": {
-            "command_line": {
-              "type": "keyword",
-              "ignore_above": 1024,
-              "fields": {
-                "caseless": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "normalizer": "lowercase"
-                }
-              }
-            },
-            "parent": {
-              "properties": {
-                "executable": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "fields": {
-                    "caseless": {
-                      "type": "keyword",
-                      "ignore_above": 1024,
-                      "normalizer": "lowercase"
-                    }
-                  }
-                },
-                "name": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "fields": {
-                    "caseless": {
-                      "type": "keyword",
-                      "ignore_above": 1024,
-                      "normalizer": "lowercase"
-                    }
-                  }
-                },
-                "command_line": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "fields": {
-                    "caseless": {
-                      "type": "keyword",
-                      "ignore_above": 1024,
-                      "normalizer": "lowercase"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "file": {
-          "properties": {
-            "path": {
-              "type": "keyword",
-              "ignore_above": 1024,
-              "fields": {
-                "caseless": {
-                  "type": "keyword",
-                  "ignore_above": 1024,
-                  "normalizer": "lowercase"
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}
@@ -4,19 +4,11 @@
 {%- set role = GLOBALS.role.split('-')[1] %}
 {%- from 'firewall/containers.map.jinja' import NODE_CONTAINERS %}

-{%- set NODE_NETWORKS = [] %}
-{%- for NETNAME, NETWORK in DOCKERMERGED.networks.items() %}
-{%-   if not NETWORK.get('manager_only') or GLOBALS.get('is_manager', False) %}
-{%-     do NODE_NETWORKS.append(NETNAME) %}
-{%-   endif %}
-{%- endfor %}
-
 {%- set PR = [] %}
 {%- set D1 = [] %}
 {%- set D2 = [] %}
 {%- for container in NODE_CONTAINERS %}
 {%-   set IP = DOCKERMERGED.containers[container].ip %}
-{%-   set BRIDGE = DOCKERMERGED.containers[container].network %}
 {%-   if DOCKERMERGED.containers[container].port_bindings is defined %}
 {%-     for binding in DOCKERMERGED.containers[container].port_bindings %}
 {#-       cant split int so we convert to string #}
@@ -43,11 +35,11 @@
 {%-         endif %}
 {%-         do PR.append("-A POSTROUTING -s " ~ DOCKERMERGED.containers[container].ip ~ "/32 -d " ~ DOCKERMERGED.containers[container].ip ~ "/32 -p " ~  proto ~ " -m " ~ proto  ~ " --dport " ~ containerPort ~ " -j MASQUERADE") %}
 {%-         if bindip | length and bindip != '0.0.0.0' %}
-{%-           do D1.append("-A DOCKER -d " ~ bindip ~ "/32 ! -i " ~ BRIDGE ~ " -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKERMERGED.containers[container].ip ~ ":" ~ containerPort) %}
+{%-           do D1.append("-A DOCKER -d " ~ bindip ~ "/32 ! -i sobridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKERMERGED.containers[container].ip ~ ":" ~ containerPort) %}
 {%-         else %}
-{%-           do D1.append("-A DOCKER ! -i " ~ BRIDGE ~ " -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKERMERGED.containers[container].ip ~ ":" ~ containerPort) %}
+{%-           do D1.append("-A DOCKER ! -i sobridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKERMERGED.containers[container].ip ~ ":" ~ containerPort) %}
 {%-         endif %}
-{%-         do D2.append("-A DOCKER -d " ~ DOCKERMERGED.containers[container].ip ~ "/32 ! -i " ~ BRIDGE ~ " -o " ~ BRIDGE ~ " -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ containerPort ~ " -j ACCEPT") %}
+{%-         do D2.append("-A DOCKER -d " ~ DOCKERMERGED.containers[container].ip ~ "/32 ! -i sobridge -o sobridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ containerPort ~ " -j ACCEPT") %}
 {%-     endfor %}
 {%-   endif %}
 {%- endfor %}
@@ -60,15 +52,11 @@
 :DOCKER - [0:0]
 -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
 -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-{%- for NETNAME in NODE_NETWORKS %}
-A POSTROUTING -s {{ DOCKERMERGED.networks[NETNAME].range }} ! -o {{ NETNAME }} -j MASQUERADE
-{%- endfor %}
+-A POSTROUTING -s {{DOCKERMERGED.range}} ! -o sobridge -j MASQUERADE
 {%- for rule in PR %}
 {{ rule }}
 {%- endfor %}
-{%- for NETNAME in NODE_NETWORKS %}
-A DOCKER -i {{ NETNAME }} -j RETURN
-{%- endfor %}
+-A DOCKER -i sobridge -j RETURN
 {%- for rule in D1 %}
 {{ rule }}
 {%- endfor %}
@@ -109,12 +97,10 @@ COMMIT
 {%- endif %}
 -A FORWARD -j DOCKER-USER
 -A FORWARD -j DOCKER-ISOLATION-STAGE-1
-{%- for NETNAME in NODE_NETWORKS %}
-A FORWARD -o {{ NETNAME }} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o {{ NETNAME }} -j DOCKER
-A FORWARD -i {{ NETNAME }} ! -o {{ NETNAME }} -j ACCEPT
-A FORWARD -i {{ NETNAME }} -o {{ NETNAME }} -j ACCEPT
-{%- endfor %}
+-A FORWARD -o sobridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -o sobridge -j DOCKER
+-A FORWARD -i sobridge ! -o sobridge -j ACCEPT
+-A FORWARD -i sobridge -o sobridge -j ACCEPT
 -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 -A FORWARD -i lo -j ACCEPT
 -A FORWARD -m conntrack --ctstate INVALID -j DROP
@@ -126,18 +112,13 @@ COMMIT
 {%- for rule in D2 %}
 {{ rule }}
 {%- endfor %}
-{% for NETNAME in NODE_NETWORKS %}
-A DOCKER-ISOLATION-STAGE-1 -i {{ NETNAME }} ! -o {{ NETNAME }} -j DOCKER-ISOLATION-STAGE-2
-{%- endfor %}
+
+-A DOCKER-ISOLATION-STAGE-1 -i sobridge ! -o sobridge -j DOCKER-ISOLATION-STAGE-2
 -A DOCKER-ISOLATION-STAGE-1 -j RETURN
-{%- for NETNAME in NODE_NETWORKS %}
-A DOCKER-ISOLATION-STAGE-2 -o {{ NETNAME }} -j DROP
-{%- endfor %}
+-A DOCKER-ISOLATION-STAGE-2 -o sobridge -j DROP
 -A DOCKER-ISOLATION-STAGE-2 -j RETURN
-{%- for NETNAME in NODE_NETWORKS %}
-A DOCKER-USER ! -i {{ NETNAME }} -o {{ NETNAME }} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER ! -i {{ NETNAME }} -o {{ NETNAME }} -j LOGGING
-{%- endfor %}
+-A DOCKER-USER ! -i sobridge -o sobridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A DOCKER-USER ! -i sobridge -o sobridge -j LOGGING
 -A DOCKER-USER -j RETURN
 -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-dropped: "
 -A LOGGING -j DROP
@@ -4,12 +4,8 @@

 {# add our ip to self #}
 {% do FIREWALL_DEFAULT.firewall.hostgroups.self.append(GLOBALS.node_ip) %}
-{# add dockernet ranges #}
-{% for NETNAME, NETWORK in DOCKERMERGED.networks.items() %}
-{%   if not NETWORK.get('manager_only') or GLOBALS.get('is_manager', False) %}
-{%     do FIREWALL_DEFAULT.firewall.hostgroups.dockernet.append(NETWORK.range) %}
-{%   endif %}
-{% endfor %}
+{# add dockernet range #}
+{% do FIREWALL_DEFAULT.firewall.hostgroups.dockernet.append(DOCKERMERGED.range) %}

 {% if GLOBALS.role == 'so-idh' %}
 {%   from 'idh/opencanary_config.map.jinja' import IDH_PORTGROUPS %}
@@ -26,8 +26,8 @@ so-hydra:
    - hostname: hydra
    - name: so-hydra
    - networks:
-      - soauth:
-        - ipv4_address: {{ DOCKERMERGED.containers['so-hydra'].ips['soauth'] }}
+      - sobridge:
+        - ipv4_address: {{ DOCKERMERGED.containers['so-hydra'].ip }}
    - binds:
      - /opt/so/conf/hydra/:/hydra-conf:ro
      - /opt/so/log/hydra/:/hydra-log:rw
@@ -73,7 +73,7 @@ delete_so-hydra_so-status.disabled:

 wait_for_hydra:
  http.wait_for_successful_query:
-    - name: 'http://{{ DOCKERMERGED.containers['so-hydra'].ips['soauth'] }}:4444/health/alive'
+    - name: 'http://{{ GLOBALS.manager }}:4444/health/alive'
    - ssl: True
    - verify_ssl: False
    - status:
@@ -21,16 +21,12 @@ hypervisor_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://hypervisor/tools/sbin
-    - user: root
-    - group: root
    - file_mode: 744

 hypervisor_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://hypervisor/tools/sbin_jinja
-    - user: root
-    - group: root
    - template: jinja
    - file_mode: 744

@@ -86,8 +86,8 @@ idh_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://idh/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 #idh_sbin_jinja:
@@ -41,8 +41,8 @@ influxdb_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://influxdb/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 #influxdb_sbin_jinja:
@@ -94,11 +94,9 @@ metrics_link_file:
      - docker_container: so-influxdb

 # Install cron job to determine size of influxdb for telegraf
-# telegraf reads this while the cron rewrites it, so write aside and rename rather than
-# truncating in place. tgraflogdir recurses ownership, so the temp file is chowned to match
 get_influxdb_size:
  cron.present:
-    - name: 'du -s -k /nsm/influxdb | cut -f1 > /opt/so/log/telegraf/influxdb_size.log.tmp 2>&1; chown 939:939 /opt/so/log/telegraf/influxdb_size.log.tmp; mv -f /opt/so/log/telegraf/influxdb_size.log.tmp /opt/so/log/telegraf/influxdb_size.log'
+    - name: 'du -s -k /nsm/influxdb | cut -f1 > /opt/so/log/telegraf/influxdb_size.log 2>&1'
    - identifier: get_influxdb_size
    - user: root
    - minute: '*/1'
@@ -21,7 +21,6 @@ kafka_user:
    - gid: 960
    - home: /opt/so/conf/kafka
    - createhome: False
-    - shell: /sbin/nologin

 kafka_home_dir:
  file.absent:
@@ -31,16 +30,16 @@ kafka_sbin_tools:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kafka/tools/sbin
-    - user: root
-    - group: root
+    - user: 960
+    - group: 960
    - file_mode: 755

 kafka_sbin_jinja_tools:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kafka/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 960
+    - group: 960
    - file_mode: 755
    - template: jinja
    - defaults:
@@ -22,7 +22,6 @@ kibana:
    - gid: 932
    - home: /opt/so/conf/kibana
    - createhome: False
-    - shell: /sbin/nologin

 # Drop the correct nginx config based on role

@@ -37,16 +36,16 @@ kibana_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kibana/tools/sbin
-    - user: root
-    - group: root
+    - user: 932
+    - group: 939
    - file_mode: 755

 kibana_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://kibana/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 932
+    - group: 939 
    - file_mode: 755
    - template: jinja
    - defaults:
@@ -27,7 +27,6 @@ kratos:
    - uid: 928
    - gid: 928
    - home: /opt/so/conf/kratos
-    - shell: /sbin/nologin

 kratosdir:
  file.directory:
@@ -19,8 +19,8 @@ so-kratos:
    - hostname: kratos
    - name: so-kratos
    - networks:
-      - soauth:
-        - ipv4_address: {{ DOCKERMERGED.containers['so-kratos'].ips['soauth'] }}
+      - sobridge:
+        - ipv4_address: {{ DOCKERMERGED.containers['so-kratos'].ip }}
    - binds:
      - /opt/so/conf/kratos/:/kratos-conf:ro
      - /opt/so/log/kratos/:/kratos-log:rw
@@ -71,7 +71,7 @@ delete_so-kratos_so-status.disabled:

 wait_for_kratos:
  http.wait_for_successful_query:
-    - name: 'http://{{ DOCKERMERGED.containers['so-kratos'].ips['soauth'] }}:4434/'
+    - name: 'http://{{ GLOBALS.manager }}:4434/'
    - ssl: True
    - verify_ssl: False
    - status:
@@ -6,8 +6,6 @@ so-fix-salt-ldap_script:
  file.managed:
    - name: /usr/sbin/so-fix-salt-ldap.py
    - source: salt://libvirt/64962/scripts/so-fix-salt-ldap.py
-    - user: root
-    - group: root
    - mode: 744

 fix-salt-ldap:
@@ -35,14 +35,13 @@ logstash:
    - uid: 931
    - gid: 931
    - home: /opt/so/conf/logstash
-    - shell: /sbin/nologin

 logstash_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://logstash/tools/sbin
-    - user: root
-    - group: root
+    - user: 931
+    - group: 939
    - file_mode: 755

 #logstash_sbin_jinja:
@@ -113,8 +113,8 @@ manager_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://manager/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755
    - exclude_pat:
      - "*_test.py"
@@ -124,8 +124,8 @@ manager_sbin_jinja:
  file.recurse:
    - name: /usr/sbin/
    - source: salt://manager/tools/sbin_jinja/
-    - user: root
-    - group: root
+    - user: socore
+    - group: socore
    - file_mode: 755
    - template: jinja
    - show_changes: False
@@ -166,7 +166,7 @@ so-repo-sync:

 so_fleetagent_status:
  cron.present:
-    - name: '/usr/sbin/so-elasticagent-status > /opt/so/log/agents/agentstatus.log.tmp 2>&1; mv -f /opt/so/log/agents/agentstatus.log.tmp /opt/so/log/agents/agentstatus.log'
+    - name: /usr/sbin/so-elasticagent-status > /opt/so/log/agents/agentstatus.log 2>&1
    - identifier: so_fleetagent_status
    - user: root
    - minute: '*/5'
@@ -190,15 +190,11 @@ so_fleetagent_monitor:
  - month: '*'
  - dayweek: '*'

-# This tree is the source of every root-executed script (/usr/sbin, reactors, _runners,
-# engines, salt-relay.sh). SOC mounts /opt/so/saltstack rw as uid 939 but only writes
-# under local/. Do not add dir_mode/file_mode here -- SOC reads default/ and 750/640
-# would break its config load.
-root_own_saltstack_default:
+socore_own_saltstack_default:
  file.directory:
    - name: /opt/so/saltstack/default
-    - user: root
-    - group: root
+    - user: socore
+    - group: socore
    - recurse:
      - user
      - group
@@ -106,8 +106,7 @@ while [[ $# -gt 0 ]]; do
  esac
 done

-hydraContainer=${HYDRA_CONTAINER:-so-hydra}
-hydraUrl=${HYDRA_URL:-http://localhost:4445}
+hydraUrl=${HYDRA_URL:-http://127.0.0.1:4445}
 socRolesFile=${SOC_ROLES_FILE:-/opt/so/conf/soc/soc_clients_roles}
 soUID=${SOCORE_UID:-939}
 soGID=${SOCORE_GID:-939}
@@ -125,10 +124,6 @@ function fail() {
  exit 1
 }

-function hydraCurl() {
-  docker exec "$hydraContainer" curl "$@"
-}
-
 function require() {
  cmd=$1
  which "$1" 2>&1 > /dev/null
@@ -138,8 +133,8 @@ function require() {
 # Verify this environment is capable of running this script
 function verifyEnvironment() {
  require "jq"
-  require "docker"
-  response=$(hydraCurl -Ss -L ${hydraUrl}/health/alive)
+  require "curl"
+  response=$(curl -Ss -L ${hydraUrl}/health/alive)
  [[ "$response" != '{"status":"ok"}' ]] && fail "Unable to communicate with Hydra; specify URL via HYDRA_URL environment variable"
 }

@@ -169,7 +164,7 @@ function ensureRoleFileExists() {
 }

 function listClients() {
-  response=$(hydraCurl -Ss -L -f ${hydraUrl}/admin/clients)
+  response=$(curl -Ss -L -f ${hydraUrl}/admin/clients)
  [[ $? != 0 ]] && fail "Unable to communicate with Hydra"

  clientIds=$(echo "${response}" | jq -r ".[] | .client_id" | sort)
@@ -256,7 +251,7 @@ function createClient() {
 EOF
  )
  
-  response=$(hydraCurl -Ss -L --fail-with-body -X POST ${hydraUrl}/admin/clients -d "$body")
+  response=$(curl -Ss -L --fail-with-body -X POST ${hydraUrl}/admin/clients -d "$body")
  if [[ $? != 0 ]]; then
    error=$(echo $response | jq .error)
    fail "Failed to submit request to Hydra: $error"
@@ -288,7 +283,7 @@ function update() {
 EOF
  )
  
-  response=$(hydraCurl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body")
+  response=$(curl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body")
  if [[ $? != 0 ]]; then
    error=$(echo $response | jq .error)
    fail "Failed to submit request to Hydra: $error"
@@ -310,7 +305,7 @@ function generateSecret() {
 EOF
  )
  
-  response=$(hydraCurl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body")
+  response=$(curl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body")
  if [[ $? != 0 ]]; then
    error=$(echo $response | jq .error)
    fail "Failed to submit request to Hydra: $error"
@@ -322,7 +317,7 @@ function deleteClient() {

  [[ ${identityId} == "" ]] && fail "Client not found"

-  response=$(hydraCurl -Ss -XDELETE -L --fail-with-body "${hydraUrl}/admin/clients/$identityId")
+  response=$(curl -Ss -XDELETE -L --fail-with-body "${hydraUrl}/admin/clients/$identityId")
  if [[ $? != 0 ]]; then
    error=$(echo $response | jq .error)
    fail "Failed to submit request to Hydra: $error"
@@ -121,14 +121,8 @@ for i in "$@"; do
 	esac
 done

-if [[ -n "$MINION_ID" && ! "$MINION_ID" =~ ^[A-Za-z0-9._-]{1,253}$ ]]; then
-	echo "Invalid minion id: $MINION_ID"
-	log "ERROR" "Invalid minion id: $MINION_ID"
-	exit 1
-fi
-
-readonly PILLARFILE=/opt/so/saltstack/local/pillar/minions/$MINION_ID.sls
-readonly ADVPILLARFILE=/opt/so/saltstack/local/pillar/minions/adv_$MINION_ID.sls
+PILLARFILE=/opt/so/saltstack/local/pillar/minions/$MINION_ID.sls
+ADVPILLARFILE=/opt/so/saltstack/local/pillar/minions/adv_$MINION_ID.sls

 function getinstallinfo() {
 	log "INFO" "Getting install info for minion $MINION_ID"
@@ -139,23 +133,10 @@ function getinstallinfo() {
 		return 1
 	fi

-	# install.txt is controlled by the minion; only accept known keys and never eval or export them
-	local line key
-	while IFS= read -r line; do
-		[[ "$line" == *=* ]] || continue
-		key=${line%%=*}
-		case "$key" in
-			MAINIP|MNIC|NODE_DESCRIPTION|ES_HEAP_SIZE|PATCHSCHEDULENAME|INTERFACE|NODETYPE|CORECOUNT|LSHOSTNAME|LSHEAP|CPUCORES|IDH_MGTRESTRICT|IDH_SERVICES)
-				printf -v "$key" '%s' "${line#*=}"
-				;;
-			*)
-				log "WARN" "Ignoring unexpected install var from $MINION_ID: ${key:0:64}"
-				;;
-		esac
-	done <<< "$INSTALLVARS"
-
-	if [[ "$NODE_DESCRIPTION" == \'*\' ]]; then
-		NODE_DESCRIPTION=${NODE_DESCRIPTION:1:-1}
+	while read -r var; do export "$var"; done <<< "$INSTALLVARS"
+	if [ $? -ne 0 ]; then
+		log "ERROR" "Failed to source install variables"
+		return 1
 	fi

 	log "INFO" "Fetched install info for $MINION_ID (node type: ${NODETYPE:-unset})"
@@ -195,12 +176,6 @@ function pcapspace() {
 		fi
 	fi

-	# Must be checked before arithmetic expansion, which evaluates array subscripts
-	if [[ ! "$SPACESIZE" =~ ^[0-9]+$ ]]; then
-		log "ERROR" "Invalid disk size for $MINION_ID: ${SPACESIZE:0:64}"
-		return 1
-	fi
-
 	local s=$(( $SPACESIZE / 1000000 ))
 	local s1=$(( $s / 4 * $PCAP_PERCENTAGE ))

@@ -1075,57 +1050,6 @@ function updateMineAndApplyStates() {
 	fi
 }

-# Values end up in a Jinja-rendered pillar and in bash, and may come from the minion
-function validate_minion_vars() {
-	local error_msg=""
-	# Inline rather than valid_ip4: so-common is not installed yet when setup runs -o=setup
-	local octet='(25[0-5]|2[0-4][0-9]|1?[0-9]?[0-9])'
-	local ip4_re="^($octet\.){3}$octet$"
-
-	case "$NODETYPE" in
-		EVAL|STANDALONE|MANAGER|MANAGERSEARCH|MANAGERHYPE|IMPORT)
-			# Manager pillars also rewrite the CA pillar, so never accept them from a remote node
-			[[ "$OPERATION" == "setup" ]] || error_msg="Node type $NODETYPE can only be configured during setup"
-			;;
-		FLEET|IDH|HEAVYNODE|SENSOR|SEARCHNODE|RECEIVER|HYPERVISOR|DESKTOP)
-			;;
-		*)
-			error_msg="Invalid node type: ${NODETYPE:0:64}"
-			;;
-	esac
-
-	if [[ -z "$error_msg" ]]; then
-		if [[ ! "$MAINIP" =~ $ip4_re ]]; then
-			error_msg="Invalid MAINIP: ${MAINIP:0:64}"
-		elif [[ ! "$MNIC" =~ ^[A-Za-z0-9._-]*$ ]]; then
-			error_msg="Invalid MNIC: ${MNIC:0:64}"
-		elif [[ ! "$INTERFACE" =~ ^[A-Za-z0-9._-]*$ ]]; then
-			error_msg="Invalid INTERFACE: ${INTERFACE:0:64}"
-		elif [[ ! "$LSHOSTNAME" =~ ^[A-Za-z0-9._-]*$ ]]; then
-			error_msg="Invalid LSHOSTNAME: ${LSHOSTNAME:0:64}"
-		elif [[ ! "$ES_HEAP_SIZE" =~ ^([0-9]+[kKmMgG]?)?$ ]]; then
-			error_msg="Invalid ES_HEAP_SIZE: ${ES_HEAP_SIZE:0:64}"
-		elif [[ ! "$LSHEAP" =~ ^([0-9]+[kKmMgG]?)?$ ]]; then
-			error_msg="Invalid LSHEAP: ${LSHEAP:0:64}"
-		elif [[ ! "$CORECOUNT" =~ ^[0-9]*$ ]]; then
-			error_msg="Invalid CORECOUNT: ${CORECOUNT:0:64}"
-		elif [[ ! "$CPUCORES" =~ ^[0-9]*$ ]]; then
-			error_msg="Invalid CPUCORES: ${CPUCORES:0:64}"
-		elif [[ ! "$IDH_MGTRESTRICT" =~ ^(True|False)?$ ]]; then
-			error_msg="Invalid IDH_MGTRESTRICT: ${IDH_MGTRESTRICT:0:64}"
-		fi
-	fi
-
-	if [[ -n "$error_msg" ]]; then
-		log "ERROR" "$error_msg"
-		echo "$error_msg"
-		return 1
-	fi
-
-	# Free text; removing braces is enough to prevent any Jinja delimiter
-	NODE_DESCRIPTION=${NODE_DESCRIPTION//[\{\}[:cntrl:]]/}
-}
-
 function setupMinionFiles() {
 	log "INFO" "Setting up minion files for $MINION_ID (pillar: $PILLARFILE)"
 	
@@ -1137,8 +1061,6 @@ function setupMinionFiles() {
 		return 1
 	fi

-	validate_minion_vars || return 1
-
 	# Create the base minion files
 	create_minion_files || return 1

@@ -19,8 +19,6 @@ is older than debounce_seconds, this script:
  * dispatches a single `salt-run state.orchestrate orch.push_batch --async`
    with the deduped actions list passed as pillar kwargs
  * deletes the contributed intent files on successful dispatch
-  * records the orchestration jid under /opt/so/state/push_dispatched and, on
-    later passes, looks up its result and logs success or per-minion failures

 Reactor sls files (push_files, push_pillar) write intents
 but never dispatch directly
@@ -32,7 +30,6 @@ import json
 import logging
 import logging.handlers
 import os
-import re
 import subprocess
 import sys
 import time
@@ -43,22 +40,8 @@ PENDING_DIR = '/opt/so/state/push_pending'
 LOCK_FILE = os.path.join(PENDING_DIR, '.lock')
 LOG_FILE = '/opt/so/log/salt/so-push-drainer.log'

-DISPATCHED_DIR = '/opt/so/state/push_dispatched'
-
 HIGHSTATE_SENTINEL = '__highstate__'

-RESULT_CHECK_DELAY = 30
-RESULT_RECHECK_MAX = 300
-RESULT_MAX_AGE = 7200
-RESULT_CHECKS_PER_PASS = 5
-TEXT_LIMIT = 500
-
-# Lead-in salt puts on the comment of an orchestration step that raised.
-STEP_RAISED = 'An exception occurred in this state:'
-
-# salt-run --async reports the jid only in a log line (stderr by default).
-JID_RE = re.compile(r'salt/run/(\d{20})')
-

 def _make_logger():
    logger = logging.getLogger('so-push-drainer')
@@ -130,189 +113,14 @@ def _dispatch(actions, log):
    except subprocess.CalledProcessError as exc:
        log.error('dispatch failed (rc=%s): stdout=%s stderr=%s',
                  exc.returncode, exc.stdout, exc.stderr)
-        return None
+        return False
    except subprocess.TimeoutExpired:
        log.error('dispatch timed out after 60s')
-        return None
+        return False
    except Exception:
        log.exception('dispatch raised')
-        return None
-    output = '{}\n{}'.format(result.stderr or '', result.stdout or '')
-    match = JID_RE.search(output)
-    if not match:
-        log.warning('dispatch accepted but no jid found, result will not be tracked: output=%s',
-                    _trim(output))
-        return ''
-    log.info('dispatch accepted: jid=%s', match.group(1))
-    return match.group(1)
-
-
-def _trim(value):
-    text = value if isinstance(value, str) else json.dumps(value, default=str)
-    lines = [line.strip() for line in text.splitlines() if line.strip()]
-    if 'Traceback (most recent call last):' in text:
-        # Keep the lead-in and the raised exception; the frames are noise in a log line.
-        lines = [text.split('Traceback (most recent call last):', 1)[0].strip(), lines[-1]]
-    text = ' '.join(line for line in lines if line)
-    return text if len(text) <= TEXT_LIMIT else text[:TEXT_LIMIT] + '...'
-
-
-def _unlink(path, log):
-    try:
-        os.unlink(path)
-    except FileNotFoundError:
-        pass
-    except OSError:
-        log.exception('failed to remove %s', path)
-
-
-def _write_record(path, record, log):
-    try:
-        os.makedirs(DISPATCHED_DIR, exist_ok=True)
-        tmp_path = path + '.tmp'
-        with open(tmp_path, 'w') as f:
-            json.dump(record, f)
-        os.rename(tmp_path, path)
-    except Exception:
-        log.exception('failed to record dispatch %s', record.get('jid'))
-
-
-def _record_dispatch(jid, actions, paths, log):
-    record = {'jid': jid, 'dispatched_at': time.time(), 'actions': actions, 'paths': paths}
-    _write_record(os.path.join(DISPATCHED_DIR, '{}.json'.format(jid)), record, log)
-
-
-def _lookup_jid(jid, log):
-    """Returns the job cache entry for jid, {} while it is still running, or None on error."""
-    cmd = ['salt-run', 'jobs.lookup_jid', jid, '--out=json']
-    try:
-        result = subprocess.run(cmd, check=True, capture_output=True, text=True, timeout=60)
-        return json.loads(result.stdout or '{}')
-    except (subprocess.CalledProcessError, subprocess.TimeoutExpired, ValueError) as exc:
-        log.warning('lookup of jid %s failed: %s', jid, exc)
-        return None
-
-
-def _minion_failure(minion_ret):
-    if isinstance(minion_ret, dict):
-        return '; '.join(
-            '{}: {}'.format(state.get('__id__', state_key), _trim(state.get('comment', '')))
-            for state_key, state in minion_ret.items()
-            if isinstance(state, dict) and state.get('result') is False
-        )
-    # A state run rejected before it starts (e.g. another state run is in
-    # progress) returns a list of error strings instead of state results.
-    if isinstance(minion_ret, (list, str)):
-        return _trim(minion_ret)
-    return ''
-
-
-def _step_failures(step):
-    if not isinstance(step, dict) or step.get('result') is not False:
-        return []
-    failures = ['{}: {}'.format(step.get('__id__', step.get('name')), _trim(step.get('comment', '')))]
-    changes = step.get('changes')
-    minion_rets = changes.get('ret') if isinstance(changes, dict) else None
-    if isinstance(minion_rets, dict):
-        for minion, minion_ret in minion_rets.items():
-            text = _minion_failure(minion_ret)
-            if text:
-                failures.append('{}: {}'.format(minion, text))
-    return failures
-
-
-def _orch_failures(ret):
-    if not isinstance(ret, dict):
-        return [_trim(ret)]
-    failures = []
-    for job in ret.values():
-        if not isinstance(job, dict):
-            continue
-        job_ret = job.get('return')
-        data = job_ret.get('data') if isinstance(job_ret, dict) else {}
-        if not isinstance(data, dict):
-            if data:
-                failures.append(_trim(data))
-            data = {}
-        for steps in data.values():
-            if not isinstance(steps, dict):
-                failures.append(_trim(steps))
-                continue
-            for step in steps.values():
-                failures.extend(_step_failures(step))
-        if job.get('success') is False and not failures:
-            failures.append('orchestration reported failure: {}'.format(_trim(job.get('return'))))
-    return failures
-
-
-def _failed_steps(ret):
-    steps = []
-    for job in ret.values() if isinstance(ret, dict) else []:
-        job_ret = job.get('return') if isinstance(job, dict) else None
-        data = job_ret.get('data') if isinstance(job_ret, dict) else None
-        for group in data.values() if isinstance(data, dict) else []:
-            if isinstance(group, dict):
-                steps.extend(step for step in group.values() if isinstance(step, dict) and step.get('result') is False)
-    return steps
-
-
-def _result_unknown(ret):
-    # A step that raised (e.g. salt-master restarted while it waited on a queued state run)
-    # never collected the minion's return, so the state run may still have completed.
-    steps = _failed_steps(ret)
-    return bool(steps) and all(str(step.get('comment', '')).startswith(STEP_RAISED) for step in steps)
-
-
-def _recheck_delay(age):
-    return min(RESULT_RECHECK_MAX, max(RESULT_CHECK_DELAY, age / 4))
-
-
-def _check_dispatched(log, now):
-    due = []
-    for path in glob.glob(os.path.join(DISPATCHED_DIR, '*.json')):
-        record = _read_intent(path, log)
-        if not isinstance(record, dict) or not record.get('jid'):
-            _unlink(path, log)
-            continue
-        age = now - record.get('dispatched_at', 0)
-        last_check = record.get('checked_at', record.get('dispatched_at', 0))
-        if now - last_check >= _recheck_delay(age):
-            due.append((last_check, path, record, age))
-    # Least recently checked first, so pushes that are still running can't starve finished ones.
-    for _, path, record, age in sorted(due, key=lambda item: item[:2])[:RESULT_CHECKS_PER_PASS]:
-        jid = record['jid']
-        try:
-            if _report_result(record, age, log):
-                _unlink(path, log)
-            else:
-                record['checked_at'] = now
-                _write_record(path, record, log)
-        except Exception:
-            # Drop the record so one unreadable result can't fail every pass ahead of the drain.
-            log.exception('cannot evaluate result for jid=%s; no longer tracking', jid)
-            _unlink(path, log)
-
-
-def _report_result(record, age, log):
-    """Logs the outcome of a dispatched push. Returns True once the record is finished with."""
-    jid = record['jid']
-    paths = record.get('paths', [])
-    ret = _lookup_jid(jid, log)
-    if not ret:
-        if age > RESULT_MAX_AGE:
-            log.warning('no result for jid=%s after %ds, no longer tracking; paths=%s', jid, age, paths)
-            return True
        return False
-    failures = _orch_failures(ret)
-    if failures and _result_unknown(ret):
-        log.warning('push result unknown jid=%s paths=%s; the orchestration lost track of the state run, which may '
-                    'still have completed (if not, the change will be applied at the next scheduled highstate): %s',
-                    jid, paths, ' | '.join(failures))
-    elif failures:
-        log.error('push failed jid=%s paths=%s; change will be applied at the next scheduled highstate: %s',
-                  jid, paths, ' | '.join(failures))
-    else:
-        log.info('push succeeded jid=%s paths=%s', jid, paths)
+    log.info('dispatch accepted: %s', (result.stdout or '').strip())
    return True


@@ -335,9 +143,6 @@ def main():

    debounce_seconds = int(push.get('debounce_seconds', 30))

-    # Outside the lock: lookups are slow and the reactors take the same lock.
-    _check_dispatched(log, time.time())
-
    os.makedirs(PENDING_DIR, exist_ok=True)
    lock_fd = os.open(LOCK_FILE, os.O_CREAT | os.O_RDWR, 0o644)
    try:
@@ -403,16 +208,10 @@ def main():
            len(ready), len(deduped), len(combined_actions),
            debounce_duration, all_paths[:20],
        )
-        for action in deduped:
-            log.info('action: %s tgt=%s', 'highstate' if action.get('highstate') else action.get('state'),
-                     action.get('tgt'))

-        jid = _dispatch(deduped, log)
-        if jid is None:
+        if not _dispatch(deduped, log):
            log.warning('dispatch failed; leaving intent files in place for retry')
            return 1
-        if jid:
-            _record_dispatch(jid, deduped, all_paths[:20], log)

        for path, _ in ready:
            try:
@@ -1,501 +0,0 @@
-# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
-# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
-# https://securityonion.net/license; you may not use this file except in compliance with the
-# Elastic License 2.0.
-
-import importlib.util
-import json
-import logging
-import os
-import shutil
-import subprocess
-import sys
-import tempfile
-import time
-import unittest
-from importlib.machinery import SourceFileLoader
-from unittest.mock import MagicMock, patch
-
-HERE = os.path.dirname(os.path.abspath(__file__))
-SCRIPT = os.path.join(HERE, 'so-push-drainer')
-_loader = SourceFileLoader('so_push_drainer', SCRIPT)
-_spec = importlib.util.spec_from_loader('so_push_drainer', _loader)
-drainer = importlib.util.module_from_spec(_spec)
-
-# salt is not installed where these tests run; the drainer only needs salt.client.Caller.
-# Mocked only while the drainer loads: run from the repo root, 'salt' is this repo's salt/ directory.
-_salt = MagicMock()
-with patch.dict(sys.modules, {'salt': _salt, 'salt.client': _salt.client}):
-    _loader.exec_module(drainer)
-
-MASTER = 'manager.localdomain_master'
-JID = '20260930171554259426'
-ASYNC_STDERR = ('[WARNING ] Running in asynchronous mode. Results of this execution may be collected '
-                'by attaching to the master event bus or by examining the master job cache, if '
-                'configured. This execution is running under tag salt/run/{}\n'.format(JID))
-CONFLICT = ('The function "state.sls" is running as PID 372218 and was started at '
-            '2026, Sep 30 17:15:40.466233 with jid 20260930171540466233')
-
-
-def _orch_ret(steps, success=True):
-    return {MASTER: {
-        'fun': 'runner.state.orchestrate',
-        'jid': JID,
-        'return': {'data': {MASTER: steps}, 'outputter': 'highstate', 'retcode': 0 if success else 1},
-        'success': success,
-    }}
-
-
-REFRESH_STEP = {
-    'salt_|-refresh_pillar_1_|-saltutil.refresh_pillar_|-function': {
-        '__id__': 'refresh_pillar_1', 'result': True,
-        'changes': {'ret': {'manager_standalone': True}},
-        'comment': 'Function ran successfully.',
-    },
-}
-
-CONFLICT_RET = _orch_ret(dict(REFRESH_STEP, **{
-    'salt_|-apply_soc_1_|-apply_soc_1_|-state': {
-        '__id__': 'apply_soc_1', 'result': False,
-        'changes': {'out': 'highstate', 'ret': {'manager_standalone': [CONFLICT]}},
-        'comment': 'Run failed on minions: manager_standalone',
-    },
-}), success=False)
-
-STATE_FAIL_RET = _orch_ret({
-    'salt_|-apply_hydra_1_|-apply_hydra_1_|-state': {
-        '__id__': 'apply_hydra_1', 'result': False,
-        'changes': {'out': 'highstate', 'ret': {'manager_standalone': {
-            'test_|-no_license_|-no_license_|-fail_without_changes': {
-                '__id__': 'hydra.enabled_no_license_detected', 'result': False,
-                'comment': 'This is a feature supported only for customers with a valid license.',
-            },
-            'file_|-hydra_conf_|-/opt/so/conf/hydra_|-managed': {'result': True, 'comment': 'ok'},
-        }}},
-        'comment': 'Run failed on minions: manager_standalone',
-    },
-}, success=False)
-
-RAISED = ('An exception occurred in this state: Traceback (most recent call last):\n'
-          '  File "salt/client/__init__.py", line 1934, in pub\n'
-          '    raise AuthenticationError(err_msg)\n'
-          'salt.exceptions.AuthenticationError: Authentication error occurred.\n')
-
-RAISED_RET = _orch_ret(dict(REFRESH_STEP, **{
-    'salt_|-apply_hydra_1_|-apply_hydra_1_|-state': {
-        '__id__': 'apply_hydra_1', 'result': False, 'changes': {}, 'comment': RAISED,
-    },
-}), success=False)
-
-SUCCESS_RET = _orch_ret(dict(REFRESH_STEP, **{
-    'salt_|-apply_telegraf_1_|-apply_telegraf_1_|-state': {
-        '__id__': 'apply_telegraf_1', 'result': True,
-        'changes': {'out': 'highstate', 'ret': {'manager_standalone': {
-            'file_|-tgrafconf_|-/opt/so/conf/telegraf/etc/telegraf.conf_|-managed': {'result': True},
-        }}},
-        'comment': 'States ran successfully.',
-    },
-}))
-
-
-class DrainerTestCase(unittest.TestCase):
-
-    def setUp(self):
-        self.tmpdir = tempfile.mkdtemp()
-        self.pending = os.path.join(self.tmpdir, 'push_pending')
-        self.dispatched = os.path.join(self.tmpdir, 'push_dispatched')
-        os.makedirs(self.pending)
-        for name, value in (
-            ('PENDING_DIR', self.pending),
-            ('LOCK_FILE', os.path.join(self.pending, '.lock')),
-            ('DISPATCHED_DIR', self.dispatched),
-            ('LOG_FILE', os.path.join(self.tmpdir, 'log', 'so-push-drainer.log')),
-        ):
-            patcher = patch.object(drainer, name, value)
-            patcher.start()
-            self.addCleanup(patcher.stop)
-        self.log = MagicMock()
-
-    def tearDown(self):
-        shutil.rmtree(self.tmpdir, ignore_errors=True)
-
-    def write_json(self, directory, name, data):
-        os.makedirs(directory, exist_ok=True)
-        path = os.path.join(directory, name)
-        with open(path, 'w') as f:
-            if isinstance(data, str):
-                f.write(data)
-            else:
-                json.dump(data, f)
-        return path
-
-    def logged(self, level):
-        return ' '.join(c.args[0] % c.args[1:] for c in getattr(self.log, level).call_args_list)
-
-
-class TestHelpers(DrainerTestCase):
-
-    def test_make_logger_adds_handler_once(self):
-        logger = logging.getLogger('so-push-drainer')
-
-        def close_handlers():
-            for handler in logger.handlers:
-                handler.close()
-            logger.handlers.clear()
-
-        self.addCleanup(close_handlers)
-        logger.handlers.clear()
-        self.assertIs(drainer._make_logger(), logger)
-        drainer._make_logger()
-        self.assertEqual(len(logger.handlers), 1)
-        self.assertTrue(os.path.isdir(os.path.dirname(drainer.LOG_FILE)))
-
-    def test_load_push_cfg(self):
-        with patch.object(drainer.salt.client, 'Caller') as caller:
-            caller.return_value.cmd.return_value = {'enabled': False}
-            self.assertEqual(drainer._load_push_cfg(), {'enabled': False})
-            caller.return_value.cmd.return_value = 'garbage'
-            self.assertEqual(drainer._load_push_cfg(), {})
-
-    def test_read_intent(self):
-        good = self.write_json(self.pending, 'good.json', {'a': 1})
-        bad = self.write_json(self.pending, 'bad.json', '{nope')
-        self.assertEqual(drainer._read_intent(good, self.log), {'a': 1})
-        self.assertIsNone(drainer._read_intent(bad, self.log))
-        with patch('builtins.open', side_effect=RuntimeError('boom')):
-            self.assertIsNone(drainer._read_intent(good, self.log))
-        self.log.exception.assert_called_once()
-
-    def test_dedupe_actions(self):
-        actions = [
-            'not a dict',
-            {'state': 'soc'},
-            {'state': 'soc', 'tgt': '*'},
-            {'state': 'soc', 'tgt': '*', 'tgt_type': 'compound'},
-            {'highstate': True, 'tgt': '*'},
-            {'state': 'soc', 'tgt': 'node1', 'tgt_type': 'glob'},
-        ]
-        self.assertEqual(drainer._dedupe_actions(actions), [actions[2], actions[4], actions[5]])
-
-    def test_trim(self):
-        self.assertEqual(drainer._trim('  text \n'), 'text')
-        self.assertEqual(drainer._trim(['a']), '["a"]')
-        self.assertEqual(drainer._trim(None), 'null')
-        self.assertEqual(drainer._trim('x' * 600), 'x' * drainer.TEXT_LIMIT + '...')
-
-    def test_trim_traceback(self):
-        comment = ('An exception occurred in this state: Traceback (most recent call last):\n'
-                   '  File "salt/client/__init__.py", line 1934, in pub\n'
-                   '    raise AuthenticationError(err_msg)\n'
-                   'salt.exceptions.AuthenticationError: Authentication error occurred.\n')
-        self.assertEqual(drainer._trim(comment), 'An exception occurred in this state: '
-                         'salt.exceptions.AuthenticationError: Authentication error occurred.')
-        self.assertEqual(drainer._trim('line one\n  line two\n'), 'line one line two')
-
-    def test_unlink(self):
-        drainer._unlink(os.path.join(self.tmpdir, 'missing'), self.log)
-        self.log.exception.assert_not_called()
-        drainer._unlink(self.tmpdir, self.log)
-        self.log.exception.assert_called_once()
-
-
-class TestDispatch(DrainerTestCase):
-
-    def run_dispatch(self, **kwargs):
-        with patch.object(drainer.subprocess, 'run', **kwargs) as run:
-            jid = drainer._dispatch([{'state': 'soc', 'tgt': '*'}], self.log)
-        return jid, run
-
-    def test_jid_parsed_from_stderr(self):
-        jid, run = self.run_dispatch(return_value=MagicMock(stdout='', stderr=ASYNC_STDERR))
-        self.assertEqual(jid, JID)
-        cmd = run.call_args[0][0]
-        self.assertEqual(cmd[:3], ['salt-run', 'state.orchestrate', 'orch.push_batch'])
-        self.assertIn('--async', cmd)
-
-    def test_jid_parsed_from_stdout(self):
-        jid, _ = self.run_dispatch(return_value=MagicMock(stdout=ASYNC_STDERR, stderr=None))
-        self.assertEqual(jid, JID)
-
-    def test_no_jid(self):
-        jid, _ = self.run_dispatch(return_value=MagicMock(stdout='unexpected output', stderr=None))
-        self.assertEqual(jid, '')
-        self.assertIn('output=unexpected output', self.logged('warning'))
-
-    def test_failures_return_none(self):
-        for exc in (subprocess.CalledProcessError(1, 'salt-run', 'out', 'err'),
-                    subprocess.TimeoutExpired('salt-run', 60),
-                    RuntimeError('boom')):
-            jid, _ = self.run_dispatch(side_effect=exc)
-            self.assertIsNone(jid)
-
-    def test_record_dispatch(self):
-        drainer._record_dispatch(JID, [{'state': 'soc'}], ['audit:soc.config.licenseKey'], self.log)
-        with open(os.path.join(self.dispatched, JID + '.json')) as f:
-            record = json.load(f)
-        self.assertEqual(record['jid'], JID)
-        self.assertEqual(record['paths'], ['audit:soc.config.licenseKey'])
-        self.assertIn('dispatched_at', record)
-
-    def test_record_dispatch_errors(self):
-        with patch.object(drainer.os, 'makedirs', side_effect=OSError('ro')):
-            drainer._record_dispatch(JID, [], [], self.log)
-        drainer._record_dispatch(JID, [object()], [], self.log)
-        self.assertEqual(self.log.exception.call_count, 2)
-        self.assertFalse(os.path.exists(os.path.join(self.dispatched, JID + '.json')))
-
-
-class TestResults(DrainerTestCase):
-
-    def test_lookup_jid(self):
-        with patch.object(drainer.subprocess, 'run') as run:
-            run.return_value = MagicMock(stdout=json.dumps(SUCCESS_RET))
-            self.assertEqual(drainer._lookup_jid(JID, self.log), SUCCESS_RET)
-            self.assertEqual(run.call_args[0][0], ['salt-run', 'jobs.lookup_jid', JID, '--out=json'])
-            run.return_value = MagicMock(stdout='')
-            self.assertEqual(drainer._lookup_jid(JID, self.log), {})
-            run.return_value = MagicMock(stdout='not json')
-            self.assertIsNone(drainer._lookup_jid(JID, self.log))
-            run.side_effect = subprocess.TimeoutExpired('salt-run', 60)
-            self.assertIsNone(drainer._lookup_jid(JID, self.log))
-
-    def test_minion_failure_shapes(self):
-        self.assertEqual(drainer._minion_failure([CONFLICT]), json.dumps([CONFLICT]))
-        self.assertEqual(drainer._minion_failure('Rendering SLS failed'), 'Rendering SLS failed')
-        self.assertEqual(drainer._minion_failure(True), '')
-        self.assertEqual(drainer._minion_failure({'a': {'result': True}}), '')
-
-    def test_orch_failures_conflict(self):
-        failures = drainer._orch_failures(CONFLICT_RET)
-        self.assertEqual(failures[0], 'apply_soc_1: Run failed on minions: manager_standalone')
-        self.assertIn('manager_standalone', failures[1])
-        self.assertIn('is running as PID 372218', failures[1])
-        self.assertEqual(len(failures), 2)
-
-    def test_orch_failures_failed_state(self):
-        failures = drainer._orch_failures(STATE_FAIL_RET)
-        self.assertEqual(len(failures), 2)
-        self.assertIn('hydra.enabled_no_license_detected: This is a feature', failures[1])
-        self.assertNotIn('hydra_conf', failures[1])
-
-    def test_orch_failures_success(self):
-        self.assertEqual(drainer._orch_failures(SUCCESS_RET), [])
-
-    def test_orch_failures_render_error(self):
-        ret = {MASTER: {'return': {'data': {MASTER: ['Rendering SLS failed']}}, 'success': False}}
-        self.assertEqual(drainer._orch_failures(ret), ['["Rendering SLS failed"]'])
-
-    def test_orch_failures_not_a_dict(self):
-        self.assertEqual(drainer._orch_failures(['No minions matched']), ['["No minions matched"]'])
-        self.assertEqual(drainer._orch_failures('Runner error'), ['Runner error'])
-
-    def test_orch_failures_data_not_a_dict(self):
-        ret = {MASTER: {'return': {'data': ["Rendering SLS 'orch.push_batch' failed"]}, 'success': False}}
-        self.assertEqual(drainer._orch_failures(ret), ['["Rendering SLS \'orch.push_batch\' failed"]'])
-
-    def test_orch_failures_odd_changes(self):
-        for changes in ('Run failed', {'ret': ['manager_standalone']}):
-            ret = _orch_ret({'salt_|-apply_soc_1_|-apply_soc_1_|-state': {
-                '__id__': 'apply_soc_1', 'result': False, 'changes': changes, 'comment': 'Run failed on minions',
-            }}, success=False)
-            self.assertEqual(drainer._orch_failures(ret), ['apply_soc_1: Run failed on minions'])
-
-    def test_orch_failures_unparsed(self):
-        self.assertEqual(drainer._orch_failures({MASTER: 'odd'}), [])
-        ret = {MASTER: {'return': 'Exception occurred', 'success': False}}
-        self.assertEqual(drainer._orch_failures(ret), ['orchestration reported failure: Exception occurred'])
-
-    def test_result_unknown(self):
-        self.assertTrue(drainer._result_unknown(RAISED_RET))
-        for ret in (CONFLICT_RET, STATE_FAIL_RET, SUCCESS_RET, ['No minions matched'], {MASTER: 'odd'},
-                    {MASTER: {'return': {'data': {MASTER: ['Rendering SLS failed']}}, 'success': False}}):
-            self.assertFalse(drainer._result_unknown(ret), ret)
-        mixed = _orch_ret(dict(RAISED_RET[MASTER]['return']['data'][MASTER],
-                               **CONFLICT_RET[MASTER]['return']['data'][MASTER]), success=False)
-        self.assertFalse(drainer._result_unknown(mixed))
-
-    def record(self, jid, age, now):
-        return self.write_json(self.dispatched, jid + '.json', {
-            'jid': jid, 'dispatched_at': now - age, 'actions': [], 'paths': ['audit:' + jid],
-        })
-
-    def test_check_dispatched(self):
-        now = time.time()
-        results = {
-            '1_failed': CONFLICT_RET,
-            '2_ok': SUCCESS_RET,
-            '3_pending': {},
-            '4_expired': None,
-            '6_unknown': RAISED_RET,
-        }
-        young = self.record('0_young', 5, now)
-        paths = {jid: self.record(jid, 60, now) for jid in results}
-        paths['4_expired'] = self.record('4_expired', drainer.RESULT_MAX_AGE + 1, now)
-        bad = self.write_json(self.dispatched, '5_bad.json', '{nope')
-        with patch.object(drainer, '_lookup_jid', side_effect=lambda jid, log: results[jid]):
-            drainer._check_dispatched(self.log, now)
-
-        self.assertTrue(os.path.exists(young))
-        with open(paths['3_pending']) as f:
-            self.assertEqual(json.load(f)['checked_at'], now)
-        for jid in ('1_failed', '2_ok', '4_expired', '6_unknown'):
-            self.assertFalse(os.path.exists(paths[jid]), jid)
-        self.assertFalse(os.path.exists(bad))
-        self.assertIn('push failed jid=1_failed', self.logged('error'))
-        self.assertIn('is running as PID 372218', self.logged('error'))
-        self.assertIn('push succeeded jid=2_ok', self.logged('info'))
-        self.assertIn('no result for jid=4_expired', self.logged('warning'))
-        self.assertIn('push result unknown jid=6_unknown', self.logged('warning'))
-        self.assertIn('AuthenticationError: Authentication error occurred.', self.logged('warning'))
-        self.assertNotIn('6_unknown', self.logged('error'))
-
-    def test_check_dispatched_survives_bad_result(self):
-        now = time.time()
-        bad = self.record('1_bad', 60, now)
-        good = self.record('2_ok', 60, now)
-
-        def orch_failures(ret):
-            if ret == 'boom':
-                raise ValueError('unexpected shape')
-            return []
-
-        with patch.object(drainer, '_lookup_jid', side_effect=lambda jid, log: 'boom' if jid == '1_bad' else SUCCESS_RET), \
-                patch.object(drainer, '_orch_failures', side_effect=orch_failures):
-            drainer._check_dispatched(self.log, now)
-        self.assertFalse(os.path.exists(bad))
-        self.assertFalse(os.path.exists(good))
-        self.log.exception.assert_called_once()
-        self.assertIn('jid=1_bad', self.log.exception.call_args[0][0] % self.log.exception.call_args[0][1:])
-        self.assertIn('push succeeded jid=2_ok', self.logged('info'))
-
-    def test_recheck_delay(self):
-        self.assertEqual(drainer._recheck_delay(10), drainer.RESULT_CHECK_DELAY)
-        self.assertEqual(drainer._recheck_delay(400), 100)
-        self.assertEqual(drainer._recheck_delay(drainer.RESULT_MAX_AGE), drainer.RESULT_RECHECK_MAX)
-
-    def test_check_dispatched_limit_rotates(self):
-        now = time.time()
-        limit = drainer.RESULT_CHECKS_PER_PASS
-        jids = ['{:02d}'.format(i) for i in range(limit + 2)]
-        for jid in jids:
-            self.record(jid, 60, now)
-        with patch.object(drainer, '_lookup_jid', return_value={}) as lookup:
-            drainer._check_dispatched(self.log, now)
-            self.assertEqual([c.args[0] for c in lookup.call_args_list], jids[:limit])
-            lookup.reset_mock()
-            drainer._check_dispatched(self.log, now + 40)
-        self.assertEqual([c.args[0] for c in lookup.call_args_list], jids[limit:] + jids[:limit - 2])
-
-    def test_check_dispatched_not_blocked_by_running(self):
-        now = time.time()
-        for i in range(drainer.RESULT_CHECKS_PER_PASS):
-            self.record('1_running{}'.format(i), 600, now)
-        done = self.record('2_done', 60, now)
-
-        def lookup(jid, log):
-            return SUCCESS_RET if jid == '2_done' else {}
-
-        with patch.object(drainer, '_lookup_jid', side_effect=lookup) as lookup_jid:
-            drainer._check_dispatched(self.log, now)
-            self.assertTrue(os.path.exists(done))
-            lookup_jid.reset_mock()
-            drainer._check_dispatched(self.log, now + 15)
-        self.assertEqual([c.args[0] for c in lookup_jid.call_args_list], ['2_done'])
-        self.assertFalse(os.path.exists(done))
-        self.assertIn('push succeeded jid=2_done', self.logged('info'))
-
-
-class TestMain(DrainerTestCase):
-
-    def setUp(self):
-        super().setUp()
-        self.cfg = {'enabled': True, 'debounce_seconds': 30}
-        for name, kwargs in (
-            ('_make_logger', {'return_value': self.log}),
-            ('_load_push_cfg', {'side_effect': lambda: self.cfg}),
-            ('_check_dispatched', {}),
-        ):
-            patcher = patch.object(drainer, name, **kwargs)
-            setattr(self, name, patcher.start())
-            self.addCleanup(patcher.stop)
-
-    def intent(self, name, age=60, actions=None, paths=None):
-        now = time.time()
-        return self.write_json(self.pending, name, {
-            'first_touch': now - age - 5, 'last_touch': now - age,
-            'actions': [{'state': 'soc', 'tgt': '*'}] if actions is None else actions,
-            'paths': paths or ['audit:soc.config.licenseKey'],
-        })
-
-    def test_no_pending_dir(self):
-        shutil.rmtree(self.pending)
-        self.assertEqual(drainer.main(), 0)
-        self._load_push_cfg.assert_not_called()
-
-    def test_cfg_error(self):
-        self._load_push_cfg.side_effect = RuntimeError('no salt')
-        self.assertEqual(drainer.main(), 1)
-
-    def test_disabled(self):
-        self.cfg['enabled'] = False
-        self.assertEqual(drainer.main(), 0)
-        self._check_dispatched.assert_not_called()
-
-    def test_no_intents_still_checks_results(self):
-        self.assertEqual(drainer.main(), 0)
-        self._check_dispatched.assert_called_once()
-
-    def test_debounce_and_broken(self):
-        young = self.intent('young.json', age=1)
-        broken = self.write_json(self.pending, 'broken.json', '{nope')
-        with patch.object(drainer, '_dispatch') as dispatch:
-            self.assertEqual(drainer.main(), 0)
-        dispatch.assert_not_called()
-        self.assertTrue(os.path.exists(young))
-        self.assertFalse(os.path.exists(broken))
-
-    def test_broken_unlink_error_ignored(self):
-        self.write_json(self.pending, 'broken.json', '{nope')
-        with patch.object(drainer.os, 'unlink', side_effect=OSError('busy')):
-            self.assertEqual(drainer.main(), 0)
-
-    def test_no_usable_actions(self):
-        path = self.intent('empty.json', actions=[{'state': 'soc'}])
-        self.assertEqual(drainer.main(), 0)
-        self.assertFalse(os.path.exists(path))
-        self.intent('empty.json', actions=[{'state': 'soc'}])
-        with patch.object(drainer.os, 'unlink', side_effect=OSError('busy')):
-            self.assertEqual(drainer.main(), 0)
-
-    def test_dispatch_failure_keeps_intents(self):
-        path = self.intent('pillar_soc.json')
-        with patch.object(drainer, '_dispatch', return_value=None):
-            self.assertEqual(drainer.main(), 1)
-        self.assertTrue(os.path.exists(path))
-
-    def test_dispatch_records_jid(self):
-        soc = self.intent('pillar_soc.json')
-        hs = self.intent('pillar_global.json', actions=[{'highstate': True, 'tgt': '*'}], paths=['audit:global.x'])
-        with patch.object(drainer, '_dispatch', return_value=JID) as dispatch, \
-                patch.object(drainer, '_record_dispatch') as record:
-            self.assertEqual(drainer.main(), 0)
-        self.assertEqual(len(dispatch.call_args[0][0]), 2)
-        record.assert_called_once()
-        self.assertEqual(record.call_args[0][0], JID)
-        self.assertEqual(sorted(record.call_args[0][2]), ['audit:global.x', 'audit:soc.config.licenseKey'])
-        self.assertFalse(os.path.exists(soc))
-        self.assertFalse(os.path.exists(hs))
-        self.assertIn('action: highstate tgt=*', self.logged('info'))
-
-    def test_dispatch_without_jid_not_recorded(self):
-        self.intent('pillar_soc.json')
-        with patch.object(drainer, '_dispatch', return_value=''), \
-                patch.object(drainer, '_record_dispatch') as record, \
-                patch.object(drainer.os, 'unlink', side_effect=OSError('busy')):
-            self.assertEqual(drainer.main(), 0)
-        record.assert_not_called()
-        self.log.exception.assert_called_once()
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -124,8 +124,8 @@ copy_new_files() {
  
  rsync -a salt $default_salt_dir/
  rsync -a pillar $default_salt_dir/
-  chown -R root:root $default_salt_dir/salt
-  chown -R root:root $default_salt_dir/pillar
+  chown -R socore:socore $default_salt_dir/salt
+  chown -R socore:socore $default_salt_dir/pillar
  chmod 755 $default_salt_dir/pillar/firewall/addfirewall.sh

  rm -rf /tmp/sogh
@@ -129,8 +129,7 @@ while [[ $# -gt 0 ]]; do
  esac
 done

-kratosContainer=${KRATOS_CONTAINER:-so-kratos}
-kratosUrl=${KRATOS_URL:-http://localhost:4434/admin}
+kratosUrl=${KRATOS_URL:-http://127.0.0.1:4434/admin}
 databasePath=${KRATOS_DB_PATH:-/nsm/kratos/db/db.sqlite}
 databaseTimeout=${KRATOS_DB_TIMEOUT:-5000}
 bcryptRounds=${BCRYPT_ROUNDS:-12}
@@ -155,10 +154,6 @@ function fail() {
  exit 1
 }

-function kratosCurl() {
-  docker exec "$kratosContainer" curl "$@"
-}
-
 function require() {
  cmd=$1
  which "$1" 2>&1 > /dev/null
@@ -169,18 +164,18 @@ function require() {
 function verifyEnvironment() {
  require "htpasswd"
  require "jq"
-  require "docker"
+  require "curl"
  require "openssl"
  require "sqlite3"
  [[ ! -f $databasePath ]] && fail "Unable to find database file; specify path via KRATOS_DB_PATH environment variable"
-  response=$(kratosCurl -Ss -L ${kratosUrl}/)
+  response=$(curl -Ss -L ${kratosUrl}/)
  [[ "$response" != "404 page not found" ]] && fail "Unable to communicate with Kratos; specify URL via KRATOS_URL environment variable"
 }

 function findIdByEmail() {
  email=${1,,}

-  response=$(kratosCurl -Ss -L ${kratosUrl}/identities)
+  response=$(curl -Ss -L ${kratosUrl}/identities)
  identityId=$(echo "${response}" | jq -r ".[] | select(.verifiable_addresses[0].value == \"$email\") | .id")
  echo $identityId
 }
@@ -421,7 +416,7 @@ function syncAll() {
 }

 function listUsers() {
-  response=$(kratosCurl -Ss -L ${kratosUrl}/identities)
+  response=$(curl -Ss -L ${kratosUrl}/identities)
  [[ $? != 0 ]] && fail "Unable to communicate with Kratos"

  users=$(echo "${response}" | jq -r ".[] | .verifiable_addresses[0].value" | sort)
@@ -500,7 +495,7 @@ function createUser() {
 EOF
  )
  
-  response=$(kratosCurl -Ss -L ${kratosUrl}/identities -d "$addUserJson")
+  response=$(curl -Ss -L ${kratosUrl}/identities -d "$addUserJson")
  [[ $? != 0 ]] && fail "Unable to communicate with Kratos"

  identityId=$(echo "${response}" | jq -r ".id")
@@ -523,7 +518,7 @@ function updateStatus() {
  identityId=$(findIdByEmail "$email")
  [[ ${identityId} == "" ]] && fail "User not found"

-  response=$(kratosCurl -Ss -L "${kratosUrl}/identities/$identityId")
+  response=$(curl -Ss -L "${kratosUrl}/identities/$identityId")
  [[ $? != 0 ]] && fail "Unable to communicate with Kratos"

  schemaId=$(echo "$response" | jq -r .schema_id)
@@ -536,7 +531,7 @@ function updateStatus() {
    state="inactive"
  fi
  body="{ \"schema_id\": \"$schemaId\", \"state\": \"$state\", \"traits\": $traitBlock }"
-  response=$(kratosCurl -fSsL -XPUT -H "Content-Type: application/json" "${kratosUrl}/identities/$identityId" -d "$body")
+  response=$(curl -fSsL -XPUT -H "Content-Type: application/json" "${kratosUrl}/identities/$identityId" -d "$body")
  [[ $? != 0 ]] && fail "Unable to update user"
 }

@@ -555,7 +550,7 @@ function updateUserProfile() {
  identityId=$(findIdByEmail "$email")
  [[ ${identityId} == "" ]] && fail "User not found"

-  response=$(kratosCurl -Ss -L "${kratosUrl}/identities/$identityId")
+  response=$(curl -Ss -L "${kratosUrl}/identities/$identityId")
  [[ $? != 0 ]] && fail "Unable to communicate with Kratos"

  schemaId=$(echo "$response" | jq -r .schema_id)
@@ -564,7 +559,7 @@ function updateUserProfile() {
  traitBlock="{\"email\":\"$email\",\"firstName\":\"$firstName\",\"lastName\":\"$lastName\",\"note\":\"$note\"}"

  body="{ \"schema_id\": \"$schemaId\", \"state\": \"$state\", \"traits\": $traitBlock }"
-  response=$(kratosCurl -fSsL -XPUT -H "Content-Type: application/json" "${kratosUrl}/identities/$identityId" -d "$body")
+  response=$(curl -fSsL -XPUT -H "Content-Type: application/json" "${kratosUrl}/identities/$identityId" -d "$body")
  [[ $? != 0 ]] && fail "Unable to update user"
 }

@@ -574,7 +569,7 @@ function deleteUser() {
  identityId=$(findIdByEmail "$email")
  [[ ${identityId} == "" ]] && fail "User not found"

-  response=$(kratosCurl -Ss -XDELETE -L "${kratosUrl}/identities/$identityId")
+  response=$(curl -Ss -XDELETE -L "${kratosUrl}/identities/$identityId")
  [[ $? != 0 ]] && fail "Unable to communicate with Kratos"

  rolesTmpFile="${socRolesFile}.tmp"
@@ -42,8 +42,7 @@ def loadYaml(filename):
    try:
        with open(filename, "r") as file:
            content = file.read()
-            loaded = yaml.safe_load(content)
-            return loaded if loaded is not None else {}
+            return yaml.safe_load(content)
    except FileNotFoundError:
        print(f"File not found: {filename}", file=sys.stderr)
        sys.exit(1)
@@ -95,20 +95,6 @@ class TestRemove(unittest.TestCase):
        expected = "key1:\n  child1: 123\n  child2:\n    deep2: ab\nkey2: false\n"
        self.assertEqual(actual, expected)

-    def test_remove_empty_file(self):
-        filename = "/tmp/so-yaml_test-remove-empty.yaml"
-        file = open(filename, "w")
-        file.close()
-
-        code = soyaml.remove([filename, "key1"])
-        self.assertEqual(code, 0)
-
-        file = open(filename, "r")
-        actual = file.read()
-        file.close()
-
-        self.assertEqual(actual, "{}\n")
-
    def test_remove_missing_args(self):
        with patch('sys.exit', new=MagicMock()) as sysmock:
            with patch('sys.stderr', new=StringIO()) as mock_stderr:
@@ -308,36 +294,6 @@ class TestRemove(unittest.TestCase):
        expected = "key1:\n  child1: 123\n  child2:\n    deep1: 45\n    deep2: d\nkey2: false\nkey3:\n- e\n- f\n- g\n"
        self.assertEqual(actual, expected)

-    def test_add_empty_file(self):
-        filename = "/tmp/so-yaml_test-add-empty.yaml"
-        file = open(filename, "w")
-        file.close()
-
-        code = soyaml.add([filename, "telegraf.output", "BOTH"])
-        self.assertEqual(code, 0)
-
-        file = open(filename, "r")
-        actual = file.read()
-        file.close()
-
-        expected = "telegraf:\n  output: BOTH\n"
-        self.assertEqual(actual, expected)
-
-    def test_add_empty_file_simple(self):
-        filename = "/tmp/so-yaml_test-add-empty-simple.yaml"
-        file = open(filename, "w")
-        file.close()
-
-        code = soyaml.add([filename, "telegraf", "BOTH"])
-        self.assertEqual(code, 0)
-
-        file = open(filename, "r")
-        actual = file.read()
-        file.close()
-
-        expected = "telegraf: BOTH\n"
-        self.assertEqual(actual, expected)
-
    def test_replace_missing_arg(self):
        with patch('sys.exit', new=MagicMock()) as sysmock:
            with patch('sys.stderr', new=StringIO()) as mock_stderr:
@@ -390,21 +346,6 @@ class TestRemove(unittest.TestCase):
        expected = "key1:\n  child1: 123\n  child2:\n    deep1: 46\nkey2: false\nkey3:\n- e\n- f\n- g\n"
        self.assertEqual(actual, expected)

-    def test_replace_empty_file(self):
-        filename = "/tmp/so-yaml_test-replace-empty.yaml"
-        file = open(filename, "w")
-        file.close()
-
-        code = soyaml.replace([filename, "telegraf.output", "BOTH"])
-        self.assertEqual(code, 0)
-
-        file = open(filename, "r")
-        actual = file.read()
-        file.close()
-
-        expected = "telegraf:\n  output: BOTH\n"
-        self.assertEqual(actual, expected)
-
    def test_convert(self):
        self.assertEqual(soyaml.convertType("foo"), "foo")
        self.assertEqual(soyaml.convertType("foo.bar"), "foo.bar")
@@ -565,18 +506,6 @@ class TestRemove(unittest.TestCase):
            self.assertEqual(result, 2)
            self.assertEqual("", mock_stdout.getvalue())

-    def test_get_empty_file(self):
-        with patch('sys.stdout', new=StringIO()) as mock_stdout:
-            with patch('sys.stderr', new=StringIO()) as mock_stderr:
-                filename = "/tmp/so-yaml_test-get-empty.yaml"
-                file = open(filename, "w")
-                file.close()
-
-                result = soyaml.get([filename, "telegraf.output"])
-                self.assertEqual(result, 2)
-                self.assertEqual("", mock_stdout.getvalue())
-                self.assertIn("Key 'telegraf.output' not found by so-yaml.py", mock_stderr.getvalue())
-
    def test_get_usage(self):
        with patch('sys.exit', new=MagicMock()) as sysmock:
            with patch('sys.stderr', new=StringIO()) as mock_stderr:
@@ -1062,29 +991,3 @@ class TestLoadYaml(unittest.TestCase):
                    soyaml.loadYaml("/tmp/so-yaml_test-unreadable.yaml")
                    sysmock.assert_called_with(1)
                    self.assertIn("Error reading file", mock_stderr.getvalue())
-
-    def test_load_yaml_empty_file(self):
-        filename = "/tmp/so-yaml_test-load-empty.yaml"
-        file = open(filename, "w")
-        file.close()
-
-        result = soyaml.loadYaml(filename)
-        self.assertEqual(result, {})
-
-    def test_load_yaml_whitespace_only(self):
-        filename = "/tmp/so-yaml_test-load-whitespace.yaml"
-        file = open(filename, "w")
-        file.write("   \n\n  \n")
-        file.close()
-
-        result = soyaml.loadYaml(filename)
-        self.assertEqual(result, {})
-
-    def test_load_yaml_comments_only(self):
-        filename = "/tmp/so-yaml_test-load-comments.yaml"
-        file = open(filename, "w")
-        file.write("# Just a comment\n# Another comment\n")
-        file.close()
-
-        result = soyaml.loadYaml(filename)
-        self.assertEqual(result, {})
@@ -28,7 +28,6 @@ INSTALLEDSALTVERSION=$(salt --versions-report | grep Salt: | awk '{print $2}')
 # percentage like "25%"). Empty means so-soup-grid-highstate uses the salt:auto_apply:batch
 # pillar default.
 BATCHSIZE=
-DEFAULT_DOCKER_RANGE='172.17.1.0/24'
 SOUP_LOG=/root/soup.log
 SOUP_DEBUG_LOG=/root/soup-debug.log
 WHATWOULDYOUSAYYAHDOHERE=soup
@@ -606,7 +605,6 @@ preupgrade_changes() {
    [[ "$INSTALLEDVERSION" == "3.0.0" ]] && up_to_3.1.0
    [[ "$INSTALLEDVERSION" == "3.1.0" ]] && up_to_3.2.0
    [[ "$INSTALLEDVERSION" == "3.2.0" ]] && up_to_3.3.0
-    [[ "$INSTALLEDVERSION" == "3.3.0" ]] && up_to_3.4.0
    true
 }

@@ -625,7 +623,6 @@ postupgrade_changes() {
    [[ "$POSTVERSION" == "3.0.0" ]] && post_to_3.1.0
    [[ "$POSTVERSION" == "3.1.0" ]] && post_to_3.2.0
    [[ "$POSTVERSION" == "3.2.0" ]] && post_to_3.3.0
-    [[ "$POSTVERSION" == "3.3.0" ]] && post_to_3.4.0
    # All applicable post-upgrade steps completed; clear the resume marker.
    rm -f "$POSTVERSION_FILE"
    true
@@ -1176,93 +1173,6 @@ post_to_3.3.0() {
 }
 ### 3.3.0 End ###

-### 3.4.0 Scripts ###
-up_to_3.4.0() {
-  set_soauth_range
-
-  echo "Removing so-kratos, so-hydra and so-soc so they are recreated on the soauth network."
-  docker rm -f so-kratos so-hydra so-soc >> $SOUP_LOG 2>&1
-
-  for template in so-metrics-logstash.node so-metrics-logstash.stack_monitoring.node; do
-    if ! remove_elasticsearch_index_template "$template" "logstash node and node_cel index patterns reversed"; then
-      FINAL_MESSAGE_QUEUE+=("WARNING: Unable to automatically remove the $template index template. Addon integration templates may fail to load until it is removed:")
-      FINAL_MESSAGE_QUEUE+=("    - sudo so-elasticsearch-query _index_template/$template -XDELETE && so-checkin")
-    fi
-  done
-
-  INSTALLEDVERSION=3.4.0
-}
-
-set_soauth_range() {
-  local pillar_file=/opt/so/saltstack/local/pillar/docker/soc_docker.sls
-  local current_range suggested authnet authgw input
-
-  [[ -f "$pillar_file" ]] || return 0
-
-  current_range=$(so-yaml.py get -r "$pillar_file" docker.range 2>/dev/null) || return 0
-
-  # A default range gets the 172.17.2.0/24 from docker/defaults.yaml, same as a fresh
-  # install, so there is nothing to ask about.
-  [[ -n "$current_range" && "$current_range" != "$DEFAULT_DOCKER_RANGE" ]] || return 0
-
-  if so-yaml.py get -r "$pillar_file" docker.networks.soauth.range >/dev/null 2>&1; then
-    return 0
-  fi
-
-  suggested=$(echo "${current_range%%/*}" | awk -F'.' '{ printf "%s.%s.%s.%s", $1, $2, ($3 + 1) % 256, $4 }')
-
-  if [[ -z $UNATTENDED ]]; then
-    echo ""
-    echo "This grid uses a custom Docker range ($current_range). The authentication"
-    echo "services are moving to their own isolated network, which needs a second /24"
-    echo "that does not overlap it."
-    echo ""
-    while :; do
-      read -rp "Enter the network without the /24 suffix, or press Enter for ${suggested}: " input
-      [[ -z "$input" ]] && input="$suggested"
-      if valid_soauth_range "$input" "$current_range"; then
-        authnet="$input"
-        break
-      fi
-      echo "That range must be a valid IPv4 network, must not be within 172.17.0.0/24, and must not overlap ${current_range}."
-    done
-  else
-    if ! valid_soauth_range "$suggested" "$current_range"; then
-      FINAL_MESSAGE_QUEUE+=("WARNING: Unable to pick a range for the authentication network alongside $current_range. Set it manually before the next highstate:")
-      FINAL_MESSAGE_QUEUE+=("    - so-yaml.py add $pillar_file docker.networks.soauth.range <network>/24")
-      FINAL_MESSAGE_QUEUE+=("    - so-yaml.py add $pillar_file docker.networks.soauth.gateway <gateway>")
-      return 0
-    fi
-    authnet="$suggested"
-    FINAL_MESSAGE_QUEUE+=("NOTE: The authentication services moved to an isolated Docker network and were assigned ${authnet}/24.")
-    FINAL_MESSAGE_QUEUE+=("    - If that conflicts with your environment, update docker.networks.soauth in $pillar_file and run so-checkin.")
-  fi
-
-  authgw=$(echo "$authnet" | awk -F'.' '{print $1,$2,$3,1}' OFS='.')
-
-  echo "Assigning the authentication network the range ${authnet}/24."
-  so-yaml.py add "$pillar_file" docker.networks.soauth.range "${authnet}/24" >> $SOUP_LOG 2>&1
-  so-yaml.py add "$pillar_file" docker.networks.soauth.gateway "$authgw" >> $SOUP_LOG 2>&1
-}
-
-valid_soauth_range() {
-  local candidate=$1 docker_range=$2
-
-  valid_ip4 "$candidate" || return 1
-  [[ $candidate =~ ^172\.17\.0\. ]] && return 1
-  [[ "${candidate}/24" == "$docker_range" ]] && return 1
-  return 0
-}
-
-post_to_3.4.0() {
-  for idx in "metrics-logstash.node-default" "metrics-logstash.stack_monitoring.node-default"; do
-    rollover_index "$idx"
-  done
-
-  set_postversion 3.4.0
-}
-### 3.4.0 End ###
-

 repo_sync() {
  echo "Sync the local repo."
@@ -57,8 +57,8 @@ nginx_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://nginx/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 #nginx_sbin_jinja:
@@ -183,7 +183,7 @@ http {
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;

-		location ~* (^/login|^/login/.*|^/js/.*|^/css/.*|^/images/.*|^/pages/.*|^/docs/.*) {
+		location ~* (^/login/.*|^/js/.*|^/css/.*|^/images/.*|^/pages/.*|^/docs/.*) {
 			proxy_pass            http://{{ GLOBALS.manager }}:9822;
 			proxy_read_timeout    90;
 			proxy_connect_timeout 90;
@@ -3,8 +3,6 @@
 {% set BATCH = AUTOAPPLY.batch %}
 {% set BATCH_WAIT = AUTOAPPLY.batch_wait %}

-{# queue must be a top-level salt.state arg (kwarg is ignored); an int is max_queue and still fails on conflict #}
-
 {% for action in actions %}
 {%   if action.get('highstate') %}
 apply_highstate_{{ loop.index }}:
@@ -14,7 +12,8 @@ apply_highstate_{{ loop.index }}:
    - highstate: True
    - batch: {{ action.get('batch', BATCH) }}
    - batch_wait: {{ action.get('batch_wait', BATCH_WAIT) }}
-    - queue: True
+    - kwarg:
+        queue: 2
 {%   else %}
 refresh_pillar_{{ loop.index }}:
  salt.function:
@@ -30,7 +29,8 @@ apply_{{ action.state | replace('.', '_') }}_{{ loop.index }}:
      - {{ action.state }}
    - batch: {{ action.get('batch', BATCH) }}
    - batch_wait: {{ action.get('batch_wait', BATCH_WAIT) }}
-    - queue: True
+    - kwarg:
+        queue: 2
    - require:
      - salt: refresh_pillar_{{ loop.index }}
 {%   endif %}
@@ -138,7 +138,6 @@ def run():
    # top level so the reactor is robust to either shape.
    event = data.get('data', data)  # noqa: F821 -- data provided by reactor
    setting_id = event.get('setting_id', '')
-    audit_id = event.get('id')
    node_id = (event.get('node_id') or '').strip()

    app = _app_from_setting(setting_id)
@@ -151,8 +150,8 @@ def run():
    if not entry:
        LOG.warning(
            'push_pillar: app "%s" is not in pillar_push_map.yaml; change will be '
-            'picked up at the next scheduled highstate (setting_id=%s audit_id=%s)',
-            app, setting_id, audit_id,
+            'picked up at the next scheduled highstate (setting_id=%s)',
+            app, setting_id,
        )
        return {}

@@ -166,12 +165,12 @@ def run():
            'node_{}_{}'.format(node_id, app), actions,
            'audit:{}@{}'.format(setting_id, node_id),
        )
-        LOG.info('push_pillar: per-node intent updated for %s on %s (setting_id=%s audit_id=%s)',
-                 app, node_id, setting_id, audit_id)
+        LOG.info('push_pillar: per-node intent updated for %s on %s (setting_id=%s)',
+                 app, node_id, setting_id)
        return {}

    # Branch B: grid-wide app change -> use the map entry's actions as-is.
    actions = list(entry)  # copy to avoid mutating the cache
    _write_intent('pillar_{}'.format(app), actions, 'audit:{}'.format(setting_id))
-    LOG.info('push_pillar: app intent updated for %s (setting_id=%s audit_id=%s)', app, setting_id, audit_id)
+    LOG.info('push_pillar: app intent updated for %s (setting_id=%s)', app, setting_id)
    return {}
@@ -50,16 +50,16 @@ redis_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://redis/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 redis_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://redis/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939 
    - file_mode: 755
    - template: jinja

@@ -9,7 +9,7 @@
       'epel-testing.repo',
       'saltstack.repo',
       'salt-latest.repo',
-       'wazuh.repo',
+       'wazuh.repo'
       'Rocky-Base.repo',
       'Rocky-CR.repo',
       'Rocky-Debuginfo.repo',
@@ -3,8 +3,6 @@ salt_bootstrap:
  file.managed:
    - name: /usr/sbin/bootstrap-salt.sh
    - source: salt://salt/scripts/bootstrap-salt.sh
-    - user: root
-    - group: root
    - mode: 755
    - show_changes: False

@@ -12,6 +10,6 @@ salt_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://salt/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755
@@ -35,8 +35,6 @@ combine_bond_script:
  file.managed:
    - name: /usr/sbin/so-combine-bond
    - source: salt://sensor/tools/sbin_jinja/so-combine-bond
-    - user: root
-    - group: root
    - mode: 755
    - template: jinja
    - defaults:
@@ -64,8 +64,8 @@ sensoroni_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://sensoroni/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 #sensoroni_sbin_jinja:
@@ -1,3 +1,2 @@
-requests>=2.34.0
-whoisit>=4.0.5
-anyio>=4.15.1
+requests>=2.31.0
+whoisit>=2.7.0
@@ -118,33 +118,21 @@ crondetectionsbackup:
    - month: '*'
    - dayweek: '*'

-# sigma-cli only loads *.yml from the pipelines dir
 socsigmafinalpipeline:
  file.managed:
-    - name: /opt/so/conf/soc/sigma_pipelines/sigma_final_pipeline.yml
+    - name: /opt/so/conf/soc/sigma_final_pipeline.yaml
    - source: salt://soc/files/soc/sigma_final_pipeline.yaml
    - user: 939
    - group: 939
    - mode: 600
-    - makedirs: True

-# sigma-cli loads every *.yml here; clean removes anything else
-socsigmapipelines:
-  file.recurse:
-    - name: /opt/so/conf/soc/sigma_pipelines
-    - source: salt://soc/files/soc/sigma_pipelines
+socsigmasopipeline:
+  file.managed:
+    - name: /opt/so/conf/soc/sigma_so_pipeline.yaml
+    - source: salt://soc/files/soc/sigma_so_pipeline.yaml
    - user: 939
    - group: 939
-    - file_mode: 600
-    - clean: True
-    - require:
-      - file: socsigmafinalpipeline
-
-socsigmapipelinesold:
-  file.absent:
-    - names:
-      - /opt/so/conf/soc/sigma_final_pipeline.yaml
-      - /opt/so/conf/soc/sigma_so_pipeline.yaml
+    - mode: 600

 socsigmaplaybookpipeline:
  file.managed:
@@ -183,8 +171,8 @@ soc_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://soc/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 #soc_sbin_jinja:
@@ -14,8 +14,6 @@
 {%   do SOCDEFAULTS.soc.config.server.modules[module].update({'hostUrl': application_url}) %}
 {% endfor %}

-{% do SOCDEFAULTS.soc.config.server.modules.kratos.update({'publicHostUrl': 'http://' ~ DOCKERMERGED.containers['so-kratos'].ips['soauth'] ~ ':4433/'}) %}
-
 {# add all grid heavy nodes to soc.server.modules.elastic.remoteHostUrls #}
 {% for node_type, minions in salt['pillar.get']('elasticsearch:nodes', {}).items() %}
 {%   if node_type in ['heavynode'] %}
@@ -1380,7 +1380,6 @@ soc:
          retryFailureMaxAttempts: 5
        kratos:
          hostUrl:
-          publicHostUrl:
        hydra:
          hostUrl:
        elastalertengine:
@@ -1466,7 +1465,6 @@ soc:
            - core
            - emerging_threats_addon
          useEsql: false
-          esqlCaseInsensitive: true
        elastic:
          hostUrl:
          remoteHostUrls: []
@@ -1494,9 +1492,6 @@ soc:
          org: Security Onion
          bucket: telegraf/so_short_term
          verifyCert: false
-        notification:
-          dismissedPruneDays: 30
-          enabled: true
        playbook:
          autoUpdateEnabled: true
          playbookImportFrequencySeconds: 86400
@@ -1561,77 +1556,6 @@ soc:
          reconcilePersona: ""
          toolUseTurnAttempts: 12
          toolUseTurnDelayMs: 175
-          agentSessionMaxTurns: 20
-          agentStreamFlushIntervalMs: 1000
-          agentStreamIdleTimeoutSeconds: 300
-          automationSettings:
-            tickIntervalSeconds: 60
-            maxConcurrentItems: 4
-            maxQueuedItems: 0
-            alertTriageEpoch: "2026-09-24T00:00:00Z"
-          tools:
-            filterEventFields:
-              - "@timestamp"
-              - "client.name"
-              - "destination.ip"
-              - "destination.port"
-              - "destination.geo.country_name"
-              - "dns.query.name"
-              - "dns.query_name"
-              - "event.action"
-              - "event.category"
-              - "event.module"
-              - "event.dataset"
-              - "event.outcome"
-              - "event.severity"
-              - "event.severity_label"
-              - "event.type"
-              - "event_data.agent.name"
-              - "event_data.host.os.name"
-              - "file.mime_type"
-              - "file.name"
-              - "hash.md5"
-              - "hash.sha1"
-              - "host.mac"
-              - "host.name"
-              - "host.os.name"
-              - "http.method"
-              - "http.useragent"
-              - "http.virtual_host"
-              - "log.id.uid"
-              - "network.community_id"
-              - "network.protocol"
-              - "network.transport"
-              - "notice.message"
-              - "observer.name"
-              - "process.name"
-              - "process.executable"
-              - "process.entity_id"
-              - "process.command_line"
-              - "process.Ext.ancestry"
-              - "process.parent.entity_id"
-              - "process.parent.command_line"
-              - "rule.category"
-              - "rule.name"
-              - "rule.uuid"
-              - "software.name"
-              - "software.type"
-              - "software.version.unparsed"
-              - "source.ip"
-              - "source.port"
-              - "source.geo.country_name"
-              - "ssh.cypher_algorithm"
-              - "ssh.client"
-              - "ssh.server"
-              - "ssl.cipher"
-              - "ssl.server_name"
-              - "ssl.version"
-              - "system.auth.sudo.command"
-              - "user.name"
-              - "user.domain"
-              - "user.effective.name"
-              - "weird.name"
-              - "tags"
        onionconfig:
          saltstackDir: /opt/so/saltstack
          bypassEnabled: false
@@ -2807,7 +2731,7 @@ soc:
            - id: sonnet
              displayName: Claude Sonnet
              origin: USA
-              contextLimitSmall: 1000000
+              contextLimitSmall: 200000
              contextLimitLarge: 1000000
              lowBalanceColorAlert: 500000
              enabled: true
@@ -18,8 +18,8 @@ hypervisor_annotation:
    - name: /opt/so/saltstack/default/salt/hypervisor/soc_hypervisor.yaml
    - source: salt://soc/dyanno/hypervisor/soc_hypervisor.yaml.jinja
    - template: jinja
-    - user: root
-    - group: root
+    - user: socore
+    - group: socore
    - defaults:
        HYPERVISORS: {{ HYPERVISORS }}
        baseDomainStatus: {{ salt['pillar.get']('baseDomain:status', 'Initialized') }}
@@ -23,9 +23,7 @@ so-soc:
    - name: so-soc
    - networks:
      - sobridge:
-        - ipv4_address: {{ DOCKERMERGED.containers['so-soc'].ips['sobridge'] }}
-      - soauth:
-        - ipv4_address: {{ DOCKERMERGED.containers['so-soc'].ips['soauth'] }}
+        - ipv4_address: {{ DOCKERMERGED.containers['so-soc'].ip }}
    - binds:
      - /nsm/rules:/nsm/rules:rw
      - /opt/so/conf/strelka:/opt/sensoroni/yara:rw
@@ -47,8 +45,9 @@ so-soc:
 {% endif %}
      - /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro
      - /opt/so/conf/soc/banner.md:/opt/sensoroni/html/login/banner.md:ro
-      - /opt/so/conf/soc/sigma_pipelines:/opt/sensoroni/sigma_pipelines:ro
+      - /opt/so/conf/soc/sigma_so_pipeline.yaml:/opt/sensoroni/sigma_so_pipeline.yaml:ro
      - /opt/so/conf/soc/sigma_playbook_pipeline.yaml:/opt/sensoroni/sigma_playbook_pipeline.yaml:ro
+      - /opt/so/conf/soc/sigma_final_pipeline.yaml:/opt/sensoroni/sigma_final_pipeline.yaml:ro
      - /opt/so/conf/soc/playbook_placeholder_map.yaml:/opt/sensoroni/playbook_placeholder_map.yaml:ro
      - /opt/so/conf/soc/playbook_placeholder_map_custom.yaml:/opt/sensoroni/playbook_placeholder_map_custom.yaml:ro
      - /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro
@@ -106,7 +105,6 @@ so-soc:
      - file: socclientsroles
      - file: socplaybookplaceholdermap
      - file: socplaybookplaceholdermapcustom
-      - file: socsigmapipelines

 delete_so-soc_so-status.disabled:
  file.uncomment:
@@ -1,477 +0,0 @@
-name: Security Onion ES|QL Pipeline
-# ES|QL query settings
-priority: 92
-transformations:
-    - id: esql_default_index
-      type: set_state
-      key: index
-      val: .ds-logs-*
-    - id: esql_source_metadata
-      type: set_state
-      key: metadata
-      val: "_id, _index, _source"
-    - id: esql_source_keep
-      type: set_state
-      key: keep
-      val: "_id, _index, _source"
-    # unmapped fields read as null instead of failing the query
-    - id: esql_unmapped_fields
-      type: set_state
-      key: unmapped_fields
-      val: nullify
-    # FROM targets per logsource, any namespace; later entries win, correlations get the union
-    - id: esql_index_process_creation
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.process-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-system.security-*
-        - .ds-logs-windows.powershell-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-sysmon_linux.log-*
-        - .ds-logs-auditd_manager.auditd-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        category: process_creation
-    - id: esql_index_process_creation_windows
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.process-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-system.security-*
-        - .ds-logs-windows.powershell-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: process_creation
-    - id: esql_index_process_creation_linux
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.process-*
-        - .ds-logs-sysmon_linux.log-*
-        - .ds-logs-auditd_manager.auditd-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: linux
-        category: process_creation
-    - id: esql_index_process_creation_macos
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.process-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: macos
-        category: process_creation
-    - id: esql_index_file
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.file-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-sysmon_linux.log-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: file_event
-      - type: logsource
-        category: file_delete
-      - type: logsource
-        category: file_rename
-      - type: logsource
-        category: file_change
-      - type: logsource
-        category: file_access
-    - id: esql_index_file_windows
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.file-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: file_event
-      - type: logsource
-        product: windows
-        category: file_delete
-      - type: logsource
-        product: windows
-        category: file_rename
-      - type: logsource
-        product: windows
-        category: file_change
-      - type: logsource
-        product: windows
-        category: file_access
-    - id: esql_index_file_linux
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.file-*
-        - .ds-logs-sysmon_linux.log-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        product: linux
-        category: file_event
-      - type: logsource
-        product: linux
-        category: file_delete
-      - type: logsource
-        product: linux
-        category: file_rename
-      - type: logsource
-        product: linux
-        category: file_change
-      - type: logsource
-        product: linux
-        category: file_access
-    - id: esql_index_file_macos
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.file-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        product: macos
-        category: file_event
-      - type: logsource
-        product: macos
-        category: file_delete
-      - type: logsource
-        product: macos
-        category: file_rename
-      - type: logsource
-        product: macos
-        category: file_change
-      - type: logsource
-        product: macos
-        category: file_access
-    - id: esql_index_registry
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.registry-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: registry_set
-      - type: logsource
-        category: registry_add
-      - type: logsource
-        category: registry_delete
-      - type: logsource
-        category: registry_event
-    - id: esql_index_library
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.library-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: image_load
-      - type: logsource
-        category: driver_load
-    - id: esql_index_endpoint_network
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.network-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-sysmon_linux.log-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: network_connection
-      - type: logsource
-        category: dns_query
-    - id: esql_index_endpoint_network_windows
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.network-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: network_connection
-      - type: logsource
-        product: windows
-        category: dns_query
-    - id: esql_index_endpoint_network_linux
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.network-*
-        - .ds-logs-sysmon_linux.log-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        product: linux
-        category: network_connection
-      - type: logsource
-        product: linux
-        category: dns_query
-    - id: esql_index_endpoint_network_macos
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-endpoint.events.network-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        product: macos
-        category: network_connection
-      - type: logsource
-        product: macos
-        category: dns_query
-    - id: esql_index_sysmon_only
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: process_access
-      - type: logsource
-        category: create_remote_thread
-      - type: logsource
-        category: pipe_created
-      - type: logsource
-        category: create_stream_hash
-      - type: logsource
-        category: wmi_event
-      - type: logsource
-        category: raw_access_thread
-      - type: logsource
-        category: process_tampering
-      - type: logsource
-        category: sysmon_status
-      - type: logsource
-        category: sysmon_error
-      - type: logsource
-        category: file_executable_detected
-      - type: logsource
-        category: file_block_executable
-      - type: logsource
-        category: file_block_shredding
-      - type: logsource
-        category: clipboard_capture
-      - type: logsource
-        product: windows
-        service: sysmon
-    - id: esql_index_ps_operational
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-windows.powershell_operational-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: ps_script
-      - type: logsource
-        category: ps_module
-      - type: logsource
-        product: windows
-        service: powershell
-    - id: esql_index_ps_classic
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-windows.powershell-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: ps_classic_start
-      - type: logsource
-        category: ps_classic_provider_start
-      - type: logsource
-        category: ps_classic_script
-      - type: logsource
-        product: windows
-        service: powershell-classic
-    - id: esql_index_win_security
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-system.security-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: windows
-        service: security
-    - id: esql_index_win_system
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-system.system-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: windows
-        service: system
-    - id: esql_index_win_application
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-system.application-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: windows
-        service: application
-    - id: esql_index_linux_auth
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-system.auth-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        product: linux
-        service: auth
-      - type: logsource
-        product: linux
-        service: sshd
-      - type: logsource
-        product: linux
-        service: sudo
-    - id: esql_index_linux_syslog
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-system.syslog-*
-        - .ds-logs-syslog-so-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: linux
-        service: syslog
-    - id: esql_index_linux_auditd
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-auditd_manager.auditd-*
-        - .ds-logs-auditd.log-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: linux
-        service: auditd
-    - id: esql_index_network
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-zeek-so-*
-        - .ds-logs-suricata-so-*
-        - .ds-logs-suricata.alerts-so-*
-        - .ds-logs-endpoint.events.network-*
-        - .ds-logs-windows.sysmon_operational-*
-        - .ds-logs-sysmon_linux.log-*
-        - .ds-logs-windows.forwarded-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        category: network
-    - id: esql_index_so_network
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-zeek-so-*
-        - .ds-logs-suricata-so-*
-        - .ds-logs-import-so-*
-      rule_cond_op: or
-      rule_conditions:
-      - type: logsource
-        category: network
-        service: connection
-      - type: logsource
-        category: network
-        service: dns
-      - type: logsource
-        category: network
-        service: http
-      - type: logsource
-        category: network
-        service: file
-      - type: logsource
-        category: network
-        service: x509
-      - type: logsource
-        category: network
-        service: ssl
-      - type: logsource
-        category: network
-        service: ssh
-      - type: logsource
-        category: dns
-    - id: esql_index_zeek
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-zeek-so-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: zeek
-    - id: esql_index_opencanary
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-idh-so-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: opencanary
-    - id: esql_index_kratos
-      type: set_state
-      key: index
-      val:
-        - .ds-logs-kratos-so-*
-        - .ds-logs-import-so-*
-      rule_conditions:
-      - type: logsource
-        product: kratos
-
@@ -2,13 +2,13 @@ name: Security Onion - Playbook Pipeline
 priority: 97
 transformations:
    # Route to lowercase-normalized .caseless subfields for case-insensitive matching.
+    # file.path.caseless exists on Defend only (Sysmon file events lack it);
    # registry.path / dll.path / file.name have no .caseless on any source.
    - id: case_insensitive_string_fields
      type: field_name_mapping
      mapping:
        process.executable: process.executable.caseless
        process.parent.executable: process.parent.executable.caseless
-        process.parent.name: process.parent.name.caseless
        process.command_line: process.command_line.caseless
        process.parent.command_line: process.parent.command_line.caseless
        file.path: file.path.caseless
@@ -1,29 +1,6 @@
 name: Security Onion Baseline Pipeline
 priority: 90
 transformations:
-    # ES|QL scalar == returns null on multivalued fields; the
-    # backend reads this key and emits MV_INTERSECTS instead.
-    - id: declare_multivalue_fields
-      type: set_state
-      key: multivalue_fields
-      val:
-        - event.type
-        - event.action
-        - event.category
-        - tags
-        - process.args
-        - related.ip
-        - dns.resolved_ip
-    # Not every source maps .caseless; EQL/ES|QL already match case-insensitively.
-    - id: caseless_to_parent_fields
-      type: field_name_mapping
-      mapping:
-        process.executable.caseless: process.executable
-        process.name.caseless: process.name
-        process.parent.executable.caseless: process.parent.executable
-        process.parent.name.caseless: process.parent.name
-        target.process.executable.caseless: target.process.executable
-        target.process.name.caseless: target.process.name
    - id: baseline_field_name_mapping
      type: field_name_mapping
      mapping:
@@ -155,15 +155,6 @@ soc:
        description: Path to custom markdown templates for PDF report generation. All markdown files in this directory will be available as custom reports in the SOC Reports interface.
        global: True
        advanced: True
-      schedules:
-        title: Schedules
-        description: Schedules that are shared across the Security Onion product. Modify via one of the SOC Schedules view.
-        readonlyUi: True
-        global: True
-        advanced: True
-        forcedType: string
-        syntax: json
-        storage: db
      subgrids:
        title: Subordinate Grids
        description: |
@@ -405,11 +396,6 @@ soc:
            global: True
            advanced: True
            forcedType: bool
-          esqlCaseInsensitive:
-            description: "Match string values case-insensitively when converting Sigma rules. Applies to ES|QL only"
-            global: True
-            advanced: True
-            forcedType: bool
        elastic:
          index:
            description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records.
@@ -490,29 +476,6 @@ soc:
            global: True
            advanced: True
            forcedType: bool
-        notification:
-          destinations:
-            title: Notification Destinations
-            description: JSON list of notifications. Modify via the SOC Notifications view.
-            readonlyUi: True
-            global: True
-            advanced: True
-            forcedType: string
-            syntax: json
-            storage: db
-          dismissedPruneDays:
-            title: Dismissed Retention Days
-            description: The number of days to retain dismissed notifications. When a notification is dismissed, it will be pruned after this many days. Only one user need dismiss a notification for it to be pruned.
-            forcedType: int
-            global: True
-          maxListLimit:
-            description: Maximum number of notifications to display.
-            forcedType: int
-            global: True
-          enabled:
-            description: Enables or disables the SOC notification module.
-            forcedType: bool
-            global: True
        postgres:
          host:
            description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.
@@ -539,48 +502,6 @@ soc:
            global: True
            sensitive: True
            advanced: True
-        postgresmetrics:
-          host:
-            description: Hostname or IP address of the PostgreSQL server used by Telegraf. Defaults to the manager hostname.
-            global: True
-            advanced: True
-          port:
-            description: Port of the PostgreSQL server used by Telegraf.
-            global: True
-            advanced: True
-          sslMode:
-            description: "Use encrypted connections to the PostgreSQL server used by Telegraf. Must be one of the following values: disable, allow, prefer, require, verify-ca, verify-full."
-            global: True
-            advanced: True
-          database:
-            description: Database to authenticate to on the PostgreSQL server.
-            global: True
-            advanced: True
-          user:
-            description: Username to authenticate to the PostgreSQL server used by Telegraf.
-            global: True
-            advanced: True
-          password:
-            description: Password used to authenticate to the PostgreSQL server used by Telegraf.
-            global: True
-            sensitive: True
-            advanced: True
-          cacheExpirationMs:
-            description: The interval (in milliseconds) to wait before querying the DB for updated metrics.
-            global: True
-            advanced: True
-          maxMetricAgeSeconds:
-            description: The maximum age (in seconds) of metrics to display in the SOC Grid Metrics view. Metrics older than this value will not be displayed.
-            global: True
-            advanced: True
-          alarms:
-            description: JSON list of metric alarms. Modify via the SOC Grid Alarms view.
-            readonlyUi: True
-            advanced: True
-            global: True
-            forcedType: string
-            syntax: json
-            storage: db
        salt:
          longRelayTimeoutMs:
            description: Duration (in milliseconds) to wait for a response from the Salt API when executing tasks known for being long running before giving up and showing an error on the SOC UI.
@@ -839,7 +760,6 @@ soc:
                - gemini
                - openai_responses
                - openai_chat
-                - openai_embeddings
            - field: apiUrl
              label: API URL
              required: False
@@ -861,15 +781,6 @@ soc:
            description: Indicates if the Assistant Module should operate in agentic mode or not. If true, agents can work together to solve tasks.
            global: True
            forcedType: bool
-          automations:
-            description: Scheduled automations for the Onion AI assistant, managed from the Agent Studio.
-            global: True
-            advanced: True
-            readonlyUi: True
-            storage: db
-            forcedType: string
-            syntax: json
-            helpLink: onion-ai
          agents:
            description: Agent definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system agent overrides only the fields an admin may change; everything else comes from the built-in definition.
            global: True
@@ -902,9 +813,6 @@ soc:
            - field: persona
              label: Persona
              multiline: True
-            - field: maxConcurrentInstances
-              label: Max Concurrent Instances
-              forcedType: int
          skills:
            description: Skill definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system skill overrides only its enabled state and persona addendum; its tool set comes from the built-in definition.
            global: True
@@ -1008,48 +916,6 @@ soc:
            description: The number of times to retry extracting memories from a session if errors occur.
            global: True
            advanced: True
-          agentSessionMaxTurns:
-            description: Maximum number of model turns a headless agent session, such as one started by an automation, may take before it is stopped. Turns taken by delegated sub-agents count toward this limit. A session that reaches the limit is recorded as failed.
-            global: True
-            advanced: True
-            forcedType: int
-          agentStreamFlushIntervalMs:
-            description: Milliseconds between writes of a streaming headless agent turn to the database. Lower values show progress sooner in the Agent Studio at the cost of more frequent Elasticsearch updates.
-            global: True
-            advanced: True
-            forcedType: int
-          agentStreamIdleTimeoutSeconds:
-            description: Seconds a streaming headless agent turn may go without receiving any output before it is abandoned and the session is recorded as failed. Set to 0 to disable the timeout.
-            global: True
-            advanced: True
-            forcedType: int
-          automationSettings:
-            tickIntervalSeconds:
-              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0.
-              global: True
-              advanced: True
-              forcedType: int
-            maxConcurrentItems:
-              description: Maximum number of automation work items that may run at the same time. Additional work items wait in the queue until a running item finishes. User chat sessions count toward this limit but are never held back by it. Set to 0 to disable the limit.
-              global: True
-              advanced: True
-              forcedType: int
-            maxQueuedItems:
-              description: Maximum number of automation work items that may wait to start. Once the queue is full, no new work items are created until the backlog drains. Set to 0 to disable the limit.
-              global: True
-              advanced: True
-              forcedType: int
-            alertTriageEpoch:
-              description: The earliest alert time the Alert Triage automation will consider. Alerts before this time are never triaged, which keeps a first run on an existing deployment from working through old history. Must be in UTC format (2026-09-24T00:00:00Z).
-              regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'
-              regexFailureMessage: Expecting date in RFC3339 format (2026-09-24T00:00:00Z)
-              global: True
-              advanced: True
-          tools:
-            filterEventFields:
-              description: A whitelist of fields to return when OnionAI uses the query_events tool. All other fields are removed. One field per line.
-              global: True
-              multiline: True
      client:
        assistant:
          enabled:
@@ -51,8 +51,8 @@ strelka_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://strelka/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 {% else %}
@@ -64,7 +64,6 @@ suricata:
    - gid: 940
    - home: /nsm/suricata
    - createhome: False
-    - shell: /sbin/nologin

 socoregroupwithsuricata:
  group.present:
@@ -77,16 +76,16 @@ suricata_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://suricata/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

 suricata_sbin_jinja:
  file.recurse:
    - name: /usr/sbin
    - source: salt://suricata/tools/sbin_jinja
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939 
    - file_mode: 755
    - template: jinja

@@ -36,7 +36,7 @@ tgraf_sync_script_{{script}}:
    - name: /opt/so/conf/telegraf/scripts/{{script}}
    - user: root
    - group: 939
-    - mode: 750
+    - mode: 770
    - template: jinja
    - source: salt://telegraf/scripts/{{script}}
    - defaults:
@@ -49,7 +49,7 @@ tgraf_sync_script_esindexsize.sh:
    - name: /opt/so/conf/telegraf/scripts/esindexsize.sh
    - user: root
    - group: 939
-    - mode: 750
+    - mode: 770
    - source: salt://telegraf/scripts/esindexsize.sh
 {# Copy conf/elasticsearch/curl.config for telegraf to use with esindexsize.sh #}
 tgraf_sync_escurl_conf:
@@ -61,102 +61,22 @@ tgraf_sync_escurl_conf:
    - source: salt://elasticsearch/curl.config
 {% endif %}

-# so-container-stats runs on the host as somon, a docker group member, so the container does
-# not need the docker socket
-somongroup:
-  group.present:
-    - name: somon
-    - gid: 961
-
-# cron chdirs to $HOME before running a job, so home must exist
-somon:
-  user.present:
-    - uid: 961
-    - gid: 961
-    - home: /opt/so/log/somon
-    - createhome: False
-    - shell: /sbin/nologin
-    - groups:
-      - docker
-    # renumbering an existing somon is a no-op on a fresh host and lets a host created
-    # before the id changed converge instead of failing the whole telegraf state
-    - allow_uid_change: True
-    - allow_gid_change: True
-    - require:
-      - group: somongroup
-
-somonlogdir:
-  file.directory:
-    - name: /opt/so/log/somon
-    - user: 961
-    - group: 961
-    - mode: 755
-    # the lock file is not otherwise managed; recurse so a renumber rechowns it too
-    - recurse:
-      - user
-      - group
-    - require:
-      - user: somon
-
-containers_log:
-  file.managed:
-    - name: /opt/so/log/somon/containers.log
-    - user: 961
-    - group: 961
-    - mode: 644
-    - replace: False
-    - require:
-      - file: somonlogdir
-
-# telegraf reads on the same minute boundary the collector runs, and docker stats takes
-# seconds, so write aside and rename rather than truncating the file telegraf is reading.
-# ; not && so a failed run replaces the file instead of leaving stale metrics behind.
-# flock -n keeps a run that outlives its minute from racing the next one over the same tmp
-# file; the skipped run leaves a stale containers.log, which containers.sh discards by age
-so-container-stats_cron:
-  cron.present:
-    - name: "flock -n /opt/so/log/somon/containers.lock -c '/usr/sbin/so-container-stats > /opt/so/log/somon/containers.log.tmp 2>&1; mv -f /opt/so/log/somon/containers.log.tmp /opt/so/log/somon/containers.log'"
-    - identifier: so-container-stats_cron
-    - user: somon
-    - minute: '*/1'
-    - hour: '*'
-    - daymonth: '*'
-    - month: '*'
-    - dayweek: '*'
-    - require:
-      - user: somon
-
-# salt.lasthighstate touches this at order 9001, after the container starts; pre-create it so
-# docker does not create a directory at the bind mount source
-lasthighstate_placeholder:
-  file.managed:
-    - name: /opt/so/log/salt/lasthighstate
-    - mode: 644
-    - replace: False
-    - makedirs: True
-
 telegraf_sbin:
  file.recurse:
    - name: /usr/sbin
    - source: salt://telegraf/tools/sbin
-    - user: root
-    - group: root
+    - user: 939
+    - group: 939
    - file_mode: 755

-# so-container-stats needs the per-stat toggles, so it renders instead of copying
-tgraf_sbin_jinja:
-  file.recurse:
-    - name: /usr/sbin
-    - source: salt://telegraf/tools/sbin_jinja
-    - user: root
-    - group: root
-    - file_mode: 755
-    # the unit test lives beside the script; it must not ship or be rendered as jinja
-    - exclude_pat:
-      - "*_test.py"
-    - template: jinja
-    - defaults:
-        CONTAINER_STATS: {{ TELEGRAFMERGED.container_stats }}
+#telegraf_sbin_jinja:
+#  file.recurse:
+#    - name: /usr/sbin
+#    - source: salt://telegraf/tools/sbin_jinja
+#    - user: 939
+#    - group: 939 
+#    - file_mode: 755
+#    - template: jinja

 tgrafconf:
  file.managed:
@@ -10,69 +10,6 @@ telegraf:
    flush_jitter: '0s'
    debug: false
    quiet: false
-  container_stats:
-    tags:
-      identity: False
-    engine:
-      n_containers: False
-      n_containers_running: False
-      n_containers_stopped: False
-      n_containers_paused: False
-      n_images: False
-      n_cpus: False
-      n_goroutines: False
-      n_used_file_descriptors: False
-      n_listener_events: False
-      memory_total: False
-    cpu:
-      usage_percent: True
-      usage_total: False
-      usage_in_usermode: False
-      usage_in_kernelmode: False
-      usage_system: False
-      throttling_periods: False
-      throttling_throttled_periods: False
-      throttling_throttled_time: False
-      container_id: False
-    mem:
-      usage_percent: True
-      usage: False
-      limit: False
-      max_usage: False
-      active_anon: False
-      active_file: False
-      inactive_anon: False
-      inactive_file: False
-      unevictable: False
-      pgfault: False
-      pgmajfault: False
-      container_id: False
-    net:
-      rx_bytes: True
-      rx_packets: False
-      rx_errors: False
-      rx_dropped: False
-      tx_bytes: False
-      tx_packets: False
-      tx_errors: False
-      tx_dropped: False
-      container_id: False
-    blkio:
-      io_service_bytes_recursive_read: False
-      io_service_bytes_recursive_write: False
-      container_id: False
-    status:
-      uptime_ns: True
-      oomkilled: True
-      pid: False
-      exitcode: False
-      restart_count: False
-      started_at: False
-      finished_at: False
-      container_id: False
-    health:
-      health_status: False
-      failing_streak: False
  scripts:
    eval:
      - agentstatus.sh
@@ -82,7 +19,6 @@ telegraf:
      - oldpcap.sh
      - os.sh
      - raid.sh
-      - containers.sh
      - sostatus.sh
      - suriloss.sh
      - surirules.sh
@@ -98,7 +34,6 @@ telegraf:
      - os.sh
      - raid.sh
      - redis.sh
-      - containers.sh
      - sostatus.sh
      - suriloss.sh
      - surirules.sh
@@ -112,7 +47,6 @@ telegraf:
      - os.sh
      - raid.sh
      - redis.sh
-      - containers.sh
      - sostatus.sh
      - features.sh
    managerhype:
@@ -122,7 +56,6 @@ telegraf:
      - os.sh
      - raid.sh
      - redis.sh
-      - containers.sh
      - sostatus.sh
      - features.sh
    managersearch:
@@ -133,14 +66,12 @@ telegraf:
      - os.sh
      - raid.sh
      - redis.sh
-      - containers.sh
      - sostatus.sh
      - features.sh
    import:
      - influxdbsize.sh
      - lasthighstate.sh
      - os.sh
-      - containers.sh
      - sostatus.sh
    sensor:
      - checkfiles.sh
@@ -148,7 +79,6 @@ telegraf:
      - oldpcap.sh
      - os.sh
      - raid.sh
-      - containers.sh
      - sostatus.sh
      - suriloss.sh
      - surirules.sh
@@ -163,7 +93,6 @@ telegraf:
      - os.sh
      - raid.sh
      - redis.sh
-      - containers.sh
      - sostatus.sh
      - suriloss.sh
      - surirules.sh
@@ -172,14 +101,12 @@ telegraf:
    idh:
      - lasthighstate.sh
      - os.sh
-      - containers.sh
      - sostatus.sh
    searchnode:
      - eps.sh
      - lasthighstate.sh
      - os.sh
      - raid.sh
-      - containers.sh
      - sostatus.sh
      - features.sh
    receiver:
@@ -188,20 +115,16 @@ telegraf:
      - os.sh
      - raid.sh
      - redis.sh
-      - containers.sh
      - sostatus.sh
    fleet:
      - lasthighstate.sh
      - os.sh
-      - containers.sh
      - sostatus.sh
    hypervisor:
      - lasthighstate.sh
      - os.sh
-      - containers.sh
      - sostatus.sh
    desktop:
      - lasthighstate.sh
      - os.sh
-      - containers.sh
      - sostatus.sh
@@ -13,11 +13,6 @@ so-telegraf:
  docker_container.absent:
    - force: True

-so-container-stats_cron:
-  cron.absent:
-    - identifier: so-container-stats_cron
-    - user: somon
-
 so-telegraf_so-status.disabled:
  file.comment:
    - name: /opt/so/conf/so-status/so-status.conf
@@ -19,7 +19,8 @@ so-telegraf:
  docker_container.running:
    - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-telegraf:{{ GLOBALS.so_version }}
    - restart_policy: unless-stopped
-    - user: 939:939
+    - user: 939
+    - group_add: 939,920
    - environment:
      - HOST_ETC=/host/etc
      - HOST_SYS=/host/sys
@@ -37,6 +38,7 @@ so-telegraf:
      - /opt/so/conf/telegraf/etc/telegraf.conf:/etc/telegraf/telegraf.conf:ro
      - /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro
      - /var/run/utmp:/var/run/utmp:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /:/host:ro
      - /sys:/host/sys:ro
      - /proc:/host/proc:ro
@@ -49,8 +51,7 @@ so-telegraf:
      - /opt/so/log/suricata:/var/log/suricata:ro
      - /opt/so/log/raid:/var/log/raid:ro
      - /opt/so/log/sostatus:/var/log/sostatus:ro
-      - /opt/so/log/somon:/var/log/somon:ro
-      - /opt/so/log/salt/lasthighstate:/var/log/salt/lasthighstate:ro
+      - /opt/so/log/salt:/var/log/salt:ro
      - /opt/so/log/agents:/var/log/agents:ro
      {% if GLOBALS.is_manager or GLOBALS.role == 'so-heavynode' %}
      - /opt/so/conf/telegraf/etc/escurl.config:/etc/telegraf/elasticsearch.config:ro
@@ -73,8 +74,6 @@ so-telegraf:
    {%   endfor %}
    {% endif %}
    - watch:
-      - file: tgraf_sbin_jinja
-      - file: lasthighstate_placeholder
      - file: trusttheca
      - x509: telegraf_crt
      - x509: telegraf_key
@@ -84,8 +83,6 @@ so-telegraf:
      - file: tgraf_sync_script_{{script}}
    {% endfor %}
    - require:
-      - file: lasthighstate_placeholder
-      - file: somonlogdir
      - file: trusttheca
      - x509: telegraf_crt
      - x509: telegraf_key
@@ -228,6 +228,13 @@
 #   ## bond interfaces.
 #   # bond_interfaces = ["bond0"]

+# # Read metrics about docker containers
+ [[inputs.docker]]
+#   ## Docker Endpoint
+#   ##   To use TCP, set endpoint = "tcp://[ip]:[port]"
+#   ##   To use environment variables (ie, docker-machine), set endpoint = "ENV"
+   endpoint = "unix:///var/run/docker.sock"
+#

 # # Read stats from one or more Elasticsearch servers or clusters
 {%- if GLOBALS.is_manager or GLOBALS.role == 'so-heavynode' %}
@@ -335,17 +342,6 @@
   interval = "60s"
 {%- endif %}

-{%- if 'containers.sh' in TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]] %}
-{%-   do TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]].remove('containers.sh') %}
-[[inputs.exec]]
-   commands = [
-      ["/scripts/containers.sh"]
-   ]
-   data_format = "influx"
-   timeout = "15s"
-   interval = "60s"
-{%- endif %}
-
 {%- if TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]] | length > 0 %}
 [[inputs.exec]]
   commands = [
@@ -1 +1 @@
 .4.0
 .3.0