Merge pull request #16158 from Security-Onion-Solutions/mwright/advanced-agent-studio

Agentic: Agent Studio Salt Annotations

salt/common/tools/sbin/so-log-check

@@ -154,6 +154,8 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|id.orig_h"                    # false positive (zeek test data)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|emerging-all.rules"           # false positive (error in rulename)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|invalid query input"          # false positive (Invalid user input in hunt query)
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no data available for the requested dates" # false positive (pcap cypress test submits a job with an empty time frame)
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no job processor"             # false positive (same empty-time-frame job on import nodes, where no pcap processor runs)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|example"                      # false positive (example test data)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|status 200"                   # false positive (request successful, contained error string in content)
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|app_layer.error"              # false positive (suricata 7) in stats.log e.g. app_layer.error.imap.parser | Total | 0

salt/soc/soc_soc.yaml

@@ -732,11 +732,13 @@ soc:
             global: True
             advanced: True
             forcedType: int
+            readonlyUi: True
           maxDelegationDepth:
             description: Maximum delegation nesting depth for sub-agents. For example, a value of 2 lets the main agent delegate to a sub-agent that may itself delegate one level deeper. Any deeper delegation is refused and the requesting agent continues without it. Set to 0 to disable the limit.
             global: True
             advanced: True
             forcedType: int
+            readonlyUi: True
           adapters:
             description: Configuration for AI adapters used by the Onion AI assistant. Please see documentation for help on which fields are required for which protocols.
             global: True
@@ -779,6 +781,60 @@ soc:
             description: Indicates if the Assistant Module should operate in agentic mode or not. If true, agents can work together to solve tasks.
             global: True
             forcedType: bool
+          agents:
+            description: Agent definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system agent overrides only the fields an admin may change; everything else comes from the built-in definition.
+            global: True
+            advanced: False
+            readonlyUi: True
+            storage: db
+            forcedType: "[]{}"
+            helpLink: onion-ai
+            syntax: json
+            uiElements:
+            - field: name
+              label: Name
+              required: True
+            - field: enabled
+              label: Enabled
+              forcedType: bool
+            - field: isOrchestrator
+              label: Orchestrator
+              forcedType: bool
+            - field: model
+              label: Model
+            - field: allowedSkills
+              label: Skills
+              forcedType: "[]string"
+            - field: canDelegateTo
+              label: Delegates To
+              forcedType: "[]string"
+            - field: description
+              label: Description
+            - field: persona
+              label: Persona
+              multiline: True
+          skills:
+            description: Skill definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system skill overrides only its enabled state and persona addendum; its tool set comes from the built-in definition.
+            global: True
+            advanced: False
+            readonlyUi: True
+            storage: db
+            forcedType: "[]{}"
+            helpLink: onion-ai
+            syntax: json
+            uiElements:
+            - field: name
+              label: Name
+              required: True
+            - field: enabled
+              label: Enabled
+              forcedType: bool
+            - field: tools
+              label: Tools
+              forcedType: "[]string"
+            - field: persona
+              label: Persona
+              multiline: True
           agentMapping:
             Orchestrator:
               description: The initial agent in most agentic conversations. This agent will delegate requests to specialized agents.