Merge pull request #16328 from Security-Onion-Solutions/fix/socqeurymerge

combine default and alerts queries added via pillar

salt/soc/defaults.yaml

@@ -1545,7 +1545,6 @@ soc:
             Investigator: haiku@SOAI
             DetectionEngineer: haiku@SOAI
             AlertTriage: haiku@SOAI
-            Notifier: haiku@SOAI
           useMemory: false
           useMemoryScanner: false
           dontScanBefore: ""
@@ -2527,6 +2526,9 @@ soc:
           queries:
             - name: 'Group By Name, Module'
               query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
+            - name: 'Group By Assessment, Name'
+              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
+              license: oai
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
               query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
             - name: 'Group By Source IP, Name'

salt/soc/merged.map.jinja

@@ -22,7 +22,7 @@
 {% do SOCMERGED.config.server.update({'additionalCA': MANAGERMERGED.additionalCA}) %}
 {% do SOCMERGED.config.server.update({'insecureSkipVerify': MANAGERMERGED.insecureSkipVerify}) %}
 
-{# pillar.get replaces lists instead of merging them, so combine availableModels by id #}
+{# pillar.get replaces lists instead of merging them, so combine availableModels by id and alerts queries by name #}
 {% set default_models = {} %}
 {% for m in SOCDEFAULTS.config.server.client.assistant.availableModels %}
 {%   do default_models.setdefault(m.id, m) %}
@@ -41,6 +41,24 @@
 {% endfor %}
 {% do SOCMERGED.config.server.client.assistant.update({'availableModels': merged_models}) %}
 
+{% set default_queries = {} %}
+{% for q in SOCDEFAULTS.config.server.client.alerts.queries %}
+{%   do default_queries.setdefault(q.name, q) %}
+{% endfor %}
+{% set merged_queries = [] %}
+{% set merged_names = [] %}
+{% for q in SOCMERGED.config.server.client.alerts.queries or [] %}
+{%   set query = {} %}
+{%   do query.update(default_queries.get(q.get('name'), {})) %}
+{%   do query.update(q) %}
+{%   do merged_queries.append(query) %}
+{%   do merged_names.append(q.get('name')) %}
+{% endfor %}
+{% for name, q in default_queries.items() if name not in merged_names %}
+{%   do merged_queries.append(q) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.alerts.update({'queries': merged_queries}) %}
+
 {% if not SOCMERGED.config.server.modules.postgres.host %}
 {%   do SOCMERGED.config.server.modules.postgres.update({'host': GLOBALS.manager}) %}
 {% endif %}

salt/soc/soc_soc.yaml

@@ -954,10 +954,7 @@ soc:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
             AlertTriage:
-              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can send a notification but cannot acknowledge alerts or escalate to cases.
-              global: True
-            Notifier:
-              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
               global: True
           useMemory:
             description: Enables the Memory system for OnionAI
@@ -1229,6 +1226,8 @@ soc:
             - field: showSubtitle
               label: Show Query in Dropdown.
               forcedType: bool
+            - field: license
+              label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere.
           queryToggleFilters:
             description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.
             global: True