Support sigma playbooks for airgap

Merge pull request #16117 from Security-Onion-Solutions/saltthangs
update vm state applid for pillar_push_map
2026-07-27 19:26:42 +02:00 · 2026-07-27 10:30:50 -04:00 · 2026-07-27 10:25:00 -04:00 · 2026-07-27 10:14:10 -04:00 · 2026-07-27 07:41:07 -05:00 · 2026-07-26 19:25:51 -05:00
4 changed files with 12 additions and 2 deletions
@@ -231,7 +231,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|from NIC checksum offloading" # zeek reporter.log
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|marked for removal"           # docker container getting recycled
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|tcp 127.0.0.1:6791: bind: address already in use" # so-elastic-fleet agent restarting. Seen starting w/ 8.18.8 https://github.com/elastic/kibana/issues/201459
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-(tychon|aws_billing|microsoft_defender_endpoint|armis|o365_metrics|microsoft_sentinel|snyk|cyera|island_browser).*user so_kibana lacks the required permissions \[(logs|metrics)-\1" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user. This error should not be seen on fresh ES 9.3.3 installs or after SO 3.1.0 with soups addition of check_transform_health_and_reauthorize()
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-.*user so_kibana lacks the required permissions" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|manifest unknown"             # appears in so-dockerregistry log for so-tcpreplay following docker upgrade to 29.2.1-1
 fi

@@ -242,7 +242,7 @@ versionlock:
 # grain (compound supports nested grain matching via G@<key>:<subkey>:<value>).
 # pillar/vm/soc_vm.sls write path is referenced at salt/_runners/setup_hypervisor.py:856.
 vm:
-  - state: vm
+  - state: vm.user
    tgt: 'G@salt-cloud:driver:libvirt'

 # zeek: sensor_roles + so-import (5 roles).
@@ -60,6 +60,9 @@ so_repo:
  {% endif %}
    - enabled: 1
    - gpgcheck: 1
+  {% if not GLOBALS.is_manager %}
+    - sslverify: 0
+  {% endif %}

 # Only assign the kernel repo once this node's running salt matches the version this
 # SO release ships. During a soup the grid is mid-salt-upgrade; gating here keeps the
@@ -77,6 +80,9 @@ so_kernel_repo:
  {% endif %}
    - enabled: 1
    - gpgcheck: 1
+  {% if not GLOBALS.is_manager %}
+    - sslverify: 0
+  {% endif %}
    # Supplementary kernel repo: tolerate it being empty/unreachable (e.g. before the
    # manager has populated /nsm/kernelrepo) so a missing repomd.xml can't make every
    # dnf/pkg operation on the grid fail.
@@ -1512,6 +1512,10 @@ soc:
                rulesetName: sos-resources-ag
                branch: main
                folder: securityonion-normalized
+              - repo: file:///nsm/airgap-resources/playbooks/securityonion-resources-playbooks
+                rulesetName: sos-published-ag
+                branch: published
+                folder: sigma
        assistant:
          systemPromptAddendum: ""
          systemPromptAddendumMaxLength: 50000
Author	SHA1	Message	Date
Josh Brower	812310088e	Support sigma playbooks for airgap	2026-07-27 10:30:50 -04:00
Josh PattersonandGitHub	4e17390cfa	Merge pull request #16117 from Security-Onion-Solutions/saltthangs update vm state applid for pillar_push_map	2026-07-27 10:25:00 -04:00
Josh Patterson	57d629683d	update vm state applid for pillar_push_map	2026-07-27 10:14:10 -04:00
Jorge ReyesandGitHub	3666b5b0de	Merge pull request #16116 from Security-Onion-Solutions/reyesj2-patch-0 ignore all TransformTask failures for so_kibana user	2026-07-27 07:41:07 -05:00
reyesj2	7f64f143d7	ignore all TransformTask failures for so_kibana user	2026-07-26 19:25:51 -05:00
Mike ReevesandGitHub	162c66a705	Merge pull request #16115 from Security-Onion-Solutions/reyesj2-patch-0 add sslverify=0 to minion repo config. Updates are pulled from the ma…	2026-07-24 19:06:28 -04:00
reyesj2	14d11cc180	add sslverify=0 to minion repo config. Updates are pulled from the manager hosted repo	2026-07-24 16:59:42 -05:00
Josh BrowerandGitHub	112fcf7804	Merge pull request #16114 from Security-Onion-Solutions/fix/sigmapipelines Add already_running mapping	2026-07-24 23:40:45 +02:00