maxSubSessionTokens and maxDelegationDepth config settings

salt/soc/defaults.yaml

@@ -1464,7 +1464,6 @@ soc:
           sigmaRulePackages:
             - core
             - emerging_threats_addon
-          useEsql: false
         elastic:
           hostUrl:
           remoteHostUrls: []
@@ -1509,6 +1508,8 @@ soc:
         assistant:
           systemPromptAddendum: ""
           systemPromptAddendumMaxLength: 50000
+          maxSubSessionTokens: 0
+          maxDelegationDepth: 0
           adapters:
             - name: SOAI
               protocol: securityonion_ai_cloud

salt/soc/soc_soc.yaml

@@ -383,11 +383,6 @@ soc:
             global: True
             advanced: False
             helpLink: sigma
-          useEsql:
-            description: "(Pre-release) Use Elasticsearch Piped Query Language (ES|QL) instead of EQL (Elastic Query Language) for Elasticsearch queries. The Sigma converter will output ES|QL instead of EQL, allowing support for correlations."
-            global: True
-            advanced: True
-            forcedType: bool
         elastic:
           index:
             description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records.
@@ -719,6 +714,16 @@ soc:
             description: Maximum length of the system prompt addendum. Longer prompts will be truncated.
             global: True
             advanced: True
+          maxSubSessionTokens:
+            description: Maximum number of output tokens a delegated sub-session may generate across all of its turns. When the budget is reached, the sub-agent is halted and its result is returned to the parent agent. Set to 0 to disable the limit.
+            global: True
+            advanced: True
+            forcedType: int
+          maxDelegationDepth:
+            description: Maximum delegation nesting depth for sub-agents. For example, a value of 2 lets the main agent delegate to a sub-agent that may itself delegate one level deeper. Any deeper delegation is refused and the requesting agent continues without it. Set to 0 to disable the limit.
+            global: True
+            advanced: True
+            forcedType: int
           adapters:
             description: Configuration for AI adapters used by the Onion AI assistant. Please see documentation for help on which fields are required for which protocols.
             global: True