Rename Detection Engineer agent key to DetectionEngineer

The agent name is also the agentMapping config key and a SOC setting id segment, so the space made it awkward to target. Matches the rename in securityonion-soc.
Map default agents to model displayName, not id
2026-07-23 17:25:45 +02:00 · 2026-07-22 11:49:32 -04:00 · 2026-07-21 15:08:24 -04:00
2 changed files with 4 additions and 4 deletions
@@ -1530,9 +1530,9 @@ soc:
              healthTimeoutSeconds: 5
          agentic: false
          agentMapping:
-            Orchestrator: sonnet
-            Investigator: sonnet
-            Detection Engineer: sonnet
+            Orchestrator: Claude Sonnet
+            Investigator: Claude Sonnet
+            DetectionEngineer: Claude Sonnet
        onionconfig:
          saltstackDir: /opt/so/saltstack
          bypassEnabled: false
@@ -786,7 +786,7 @@ soc:
            Investigator:
              description: This agent investigates alerts, explains events and records, and hunts through event data. It can also acknowledge alerts and escalate to cases.
              global: True
-            Detection Engineer:
+            DetectionEngineer:
              description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
              global: True
      client: