Merge pull request #16323 from Security-Onion-Solutions/mreeves/alert-triage-notify-skill

Remove the Notifier agent mapping
2026-10-14 10:15:44 +02:00 · 2026-10-13 17:45:22 -04:00 · 2026-10-13 17:35:22 -04:00 · 2026-10-13 17:16:48 -04:00 · 2026-10-13 17:11:49 -04:00 · 2026-10-13 16:27:57 -04:00
2 changed files with 6 additions and 5 deletions
@@ -1545,7 +1545,6 @@ soc:
            Investigator: haiku@SOAI
            DetectionEngineer: haiku@SOAI
            AlertTriage: haiku@SOAI
-            Notifier: haiku@SOAI
          useMemory: false
          useMemoryScanner: false
          dontScanBefore: ""
@@ -2527,6 +2526,9 @@ soc:
          queries:
            - name: 'Group By Name, Module'
              query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
+            - name: 'Group By Assessment, Name'
+              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
+              license: oai
            - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
              query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
            - name: 'Group By Source IP, Name'
@@ -954,10 +954,7 @@ soc:
              description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
              global: True
            AlertTriage:
-              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
-              global: True
-            Notifier:
-              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can send a notification but cannot acknowledge alerts or escalate to cases.
              global: True
          useMemory:
            description: Enables the Memory system for OnionAI
@@ -1229,6 +1226,8 @@ soc:
            - field: showSubtitle
              label: Show Query in Dropdown.
              forcedType: bool
+            - field: license
+              label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere.
          queryToggleFilters:
            description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.
            global: True
Author	SHA1	Message	Date
Mike Reeves	b158a38099	Merge pull request #16323 from Security-Onion-Solutions/mreeves/alert-triage-notify-skill Remove the Notifier agent mapping	2026-10-13 17:45:22 -04:00
Mike Reeves	26f5d07435	Remove the Notifier agent mapping AlertTriage now sends its own notification through the Notify skill, so the Notifier agent no longer exists in SOC.	2026-10-13 17:35:22 -04:00
Mike Reeves	747abeed79	Merge pull request #16302 from Security-Onion-Solutions/mreeves/alert-assessment-groupby Add a licensed Group By Assessment, Name alerts query	2026-10-13 17:16:48 -04:00
Mike Reeves	1bcf80dd10	Group by assessment without a missing bucket The assessment is a number, and SOC's missing bucket only works on keyword fields, so the * made Elasticsearch fail parsing "__missing__" as a long. Untriaged alerts now drop out of this view.	2026-10-13 17:11:49 -04:00
Josh Patterson	e7d7676a90	Merge pull request #16322 from Security-Onion-Solutions/fix/socmerge combine default and availableModels added via pillar	2026-10-13 16:27:57 -04:00
Mike Reeves	3304aff62b	Note that an oai query also needs the agentic assistant SOC (securityonion-soc#1363) now hides a query licensed for oai unless the assistant is enabled and agentic, so the query editor's license help says so. Claude-Session: https://claude.ai/code/session_01SZLcwj68A2wLo3F8TGKsLP	2026-10-07 08:56:44 -04:00
Mike Reeves	7469d833d1	Add a licensed Group By Assessment, Name alerts query Groups alerts by the AI triage assessment, keeping untriaged alerts as a missing bucket. Query entries take an optional license feature, which SOC uses to hide this one on grids without OnionAI, and the query editor now shows it.	2026-10-06 21:14:25 -04:00