Remove the Notifier agent mapping

AlertTriage now sends its own notification through the Notify skill, so the Notifier agent no longer exists in SOC.
Merge pull request #16302 from Security-Onion-Solutions/mreeves/alert-assessment-groupby
2026-10-15 18:56:24 +02:00 · 2026-10-13 17:35:22 -04:00 · 2026-10-13 17:16:48 -04:00 · 2026-10-13 17:11:49 -04:00 · 2026-10-13 16:27:57 -04:00 · 2026-10-07 08:56:44 -04:00
2 changed files with 6 additions and 5 deletions
@@ -1545,7 +1545,6 @@ soc:
            Investigator: haiku@SOAI
            DetectionEngineer: haiku@SOAI
            AlertTriage: haiku@SOAI
-            Notifier: haiku@SOAI
          useMemory: false
          useMemoryScanner: false
          dontScanBefore: ""
@@ -2527,6 +2526,9 @@ soc:
          queries:
            - name: 'Group By Name, Module'
              query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
+            - name: 'Group By Assessment, Name'
+              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
+              license: oai
            - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
              query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
            - name: 'Group By Source IP, Name'
@@ -954,10 +954,7 @@ soc:
              description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
              global: True
            AlertTriage:
-              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
-              global: True
-            Notifier:
-              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can send a notification but cannot acknowledge alerts or escalate to cases.
              global: True
          useMemory:
            description: Enables the Memory system for OnionAI
@@ -1229,6 +1226,8 @@ soc:
            - field: showSubtitle
              label: Show Query in Dropdown.
              forcedType: bool
+            - field: license
+              label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere.
          queryToggleFilters:
            description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.
            global: True
Author	SHA1	Message	Date
Mike Reeves	26f5d07435	Remove the Notifier agent mapping AlertTriage now sends its own notification through the Notify skill, so the Notifier agent no longer exists in SOC.	2026-10-13 17:35:22 -04:00
Mike Reeves	747abeed79	Merge pull request #16302 from Security-Onion-Solutions/mreeves/alert-assessment-groupby Add a licensed Group By Assessment, Name alerts query	2026-10-13 17:16:48 -04:00
Mike Reeves	1bcf80dd10	Group by assessment without a missing bucket The assessment is a number, and SOC's missing bucket only works on keyword fields, so the * made Elasticsearch fail parsing "__missing__" as a long. Untriaged alerts now drop out of this view.	2026-10-13 17:11:49 -04:00
Josh Patterson	e7d7676a90	Merge pull request #16322 from Security-Onion-Solutions/fix/socmerge combine default and availableModels added via pillar	2026-10-13 16:27:57 -04:00
Mike Reeves	3304aff62b	Note that an oai query also needs the agentic assistant SOC (securityonion-soc#1363) now hides a query licensed for oai unless the assistant is enabled and agentic, so the query editor's license help says so. Claude-Session: https://claude.ai/code/session_01SZLcwj68A2wLo3F8TGKsLP	2026-10-07 08:56:44 -04:00
Mike Reeves	7469d833d1	Add a licensed Group By Assessment, Name alerts query Groups alerts by the AI triage assessment, keeping untriaged alerts as a missing bucket. Query entries take an optional license feature, which SOC uses to hide this one on grids without OnionAI, and the query editor now shows it.	2026-10-06 21:14:25 -04:00