FIX: pip install wheels from a root-owned directory

Root ran `pip install --find-links` against directories under /opt/so/conf, which
is 939:939 mode 770. Hardening those directories would not have helped: renaming an
entry requires write permission on the parent, not on the entry, so uid 939 could
move the wheel tree aside and substitute its own between the file.recurse that
populates it and the pip install that reads it. clean: True plus the onchanges
requisite narrowed that to a race rather than a straight win, but the window is
real and the install runs as root.

Move both wheel trees to /opt/saltstack, which is created by the salt package and
is root-owned, and state the ownership explicitly rather than relying on the files
being new:

  /opt/so/conf/salt/module_packages/docker
    -> /opt/saltstack/module_packages/docker
  /opt/so/conf/libvirt/source-packages/libvirt-python
    -> /opt/saltstack/source-packages/libvirt-python

salt.python_modules is included by salt/salt/minion/init.sls, so the docker wheels
are staged on every minion in the grid, not just the manager.

Upgraded installs keep a now-unused wheel tree in the old socore-writable location,
so remove it -- nothing reads it after this change, but leaving a writable staging
directory behind serves no purpose.

salt/elasticsearch/files/ingest/suricata.fileinfo

@@ -5,7 +5,8 @@
     { "rename": 	{ "field": "message2.proto", 			"target_field": "network.transport",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.fileinfo.filename", 	"target_field": "file.name",		"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.fileinfo.gaps", 		"target_field": "file.bytes.missing",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.fileinfo.gaps", 		"target_field": "suricata.fileinfo.gaps",	"ignore_missing": true 	} },
+    { "set":		{ "if": "ctx.suricata?.fileinfo?.gaps == false", 	"field": "file.bytes.missing",	"value": 0 		} },
     { "rename": 	{ "field": "message2.fileinfo.magic", 		"target_field": "file.mime_type",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.fileinfo.md5", 		"target_field": "hash.md5",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.fileinfo.sha1", 		"target_field": "hash.sha1",		"ignore_missing": true 	} },

salt/libvirt/packages.sls

@@ -29,16 +29,27 @@ install_libvirt-libs:
   pkg.installed:
     - name: libvirt-libs
 
+# Root pip-installs these below, so they cannot live under /opt/so/conf (939:939 mode 770):
+# write permission on that directory lets uid 939 swap the tree between this state and the
+# install. /opt/saltstack is root-owned, so the same trick does not work there.
 libvirt_python_wheel:
   file.recurse:
-    - name: /opt/so/conf/libvirt/source-packages/libvirt-python
+    - name: /opt/saltstack/source-packages/libvirt-python
     - source: salt://libvirt/source-packages/libvirt-python
+    - user: root
+    - group: root
+    - dir_mode: 755
+    - file_mode: 644
     - makedirs: True
     - clean: True
 
+old_libvirt_python_wheel:
+  file.absent:
+    - name: /opt/so/conf/libvirt/source-packages
+
 libvirt_python_module:
   cmd.run:
-    - name: /opt/saltstack/salt/bin/python3 -m pip install --no-index --find-links=/opt/so/conf/libvirt/source-packages/libvirt-python libvirt-python
+    - name: /opt/saltstack/salt/bin/python3 -m pip install --no-index --find-links=/opt/saltstack/source-packages/libvirt-python libvirt-python
     - onchanges:
       - file: libvirt_python_wheel
 

salt/salt/python_modules.sls

@@ -3,19 +3,34 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
+# These wheels are pip-installed by root below, so they cannot live under /opt/so/conf:
+# that directory is 939:939 mode 770, and write permission on it is what lets uid 939
+# rename the tree aside and substitute its own wheels between this state and the install.
+# Hardening only the files here would not help -- renaming an entry needs write on the
+# parent, not on the entry.
 docker_module_package:
   file.recurse:
-    - name: /opt/so/conf/salt/module_packages/docker
+    - name: /opt/saltstack/module_packages/docker
     - source: salt://salt/module_packages/docker
+    - user: root
+    - group: root
+    - dir_mode: 755
+    - file_mode: 644
     - clean: True
     - makedirs: True
 
+# Installs before this change left wheels in a socore-writable directory; nothing reads
+# them now, but leaving them behind leaves a writable staging area lying around.
+old_docker_module_package:
+  file.absent:
+    - name: /opt/so/conf/salt/module_packages
+
 # fail hard on this state so that soup would be cancelled on a manager (eventhough salt would have already updated)
 # on a non manager, failing hard here will prevent the minion from upgrading
 # we want to fail hard here to prevent the minion from upgrading and potetially being able to manager docker containers from a dep mismatch
 docker_python_module_install:
   cmd.run:
-    - name: /opt/saltstack/salt/bin/python3.10 -m pip install docker --no-index --find-links=/opt/so/conf/salt/module_packages/docker/ --upgrade
+    - name: /opt/saltstack/salt/bin/python3.10 -m pip install docker --no-index --find-links=/opt/saltstack/module_packages/docker/ --upgrade
     - onchanges:
       - file: docker_module_package
     - failhard: True

salt/soc/defaults.yaml

@@ -1465,6 +1465,7 @@ soc:
             - core
             - emerging_threats_addon
           useEsql: false
+          esqlCaseInsensitive: true
         elastic:
           hostUrl:
           remoteHostUrls: []

salt/soc/files/soc/sigma_so_pipeline.yaml

@@ -1,6 +1,31 @@
 name: Security Onion Baseline Pipeline
 priority: 90
 transformations:
+    # ES|QL scalar == returns null on multivalued fields; the
+    # backend reads this key and emits MV_INTERSECTS instead.
+    - id: declare_multivalue_fields
+      type: set_state
+      key: multivalue_fields
+      val:
+        - event.type
+        - event.action
+        - event.category
+        - tags
+        - process.args
+        - related.ip
+        - dns.resolved_ip
+    - id: esql_default_index
+      type: set_state
+      key: index
+      val: .ds-logs-*
+    - id: esql_source_metadata
+      type: set_state
+      key: metadata
+      val: "_id, _index, _source"
+    - id: esql_source_keep
+      type: set_state
+      key: keep
+      val: "_id, _index, _source"
     - id: baseline_field_name_mapping
       type: field_name_mapping
       mapping:

salt/soc/soc_soc.yaml

@@ -396,6 +396,11 @@ soc:
             global: True
             advanced: True
             forcedType: bool
+          esqlCaseInsensitive:
+            description: "Match string values case-insensitively when converting Sigma rules. Applies to ES|QL only"
+            global: True
+            advanced: True
+            forcedType: bool
         elastic:
           index:
             description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records.