Fix heavynode wording in soup message

allow airgap installs to reuse previously extracted docker images

.github/DISCUSSION_TEMPLATE/3-0.yml

@@ -12,6 +12,7 @@ body:
         - 3.0.0
         - 3.1.0
         - 3.2.0
+        - 3.3.0
         - Other (please provide detail below)
     validations:
       required: true

DOWNLOAD_AND_VERIFY_ISO.md

@@ -1,17 +1,17 @@
-### 3.1.0-20260528 ISO image released on 2026/05/28
+### 3.2.0-20260729 ISO image released on 2026/07/29
 
 
 ### Download and Verify
 
-3.1.0-20260528 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260528.iso
+3.2.0-20260729 ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-3.2.0-20260729.iso
  
-MD5: 9D6FF58DEEE24089D722C73169765B3E  
-SHA1: 2B8B816B6CEC3B7F96B3C5E040EBF502DD2C412F  
-SHA256: 62FAB57E247C843D6A04F0796D8162C732B65D82FC3E4A59D087135B9FD32912  
+MD5: B1E10F46DF872B655C29325DF965A4DB  
+SHA1: 0F3C7ED80F6D326B7A993C2F899B986320C01BF9  
+SHA256: 7465163C1D1ADFCDC3935530EAFB312E987C016941ADC11841B214553314D1FF  
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260528.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.2.0-20260729.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS  
@@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260528.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.2.0-20260729.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260528.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-3.2.0-20260729.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-3.1.0-20260528.iso.sig securityonion-3.1.0-20260528.iso
+gpg --verify securityonion-3.2.0-20260729.iso.sig securityonion-3.2.0-20260729.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Wed 27 May 2026 03:03:59 PM EDT using RSA key ID FE507013
+gpg: Signature made Tue 28 Jul 2026 06:17:34 PM EDT using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.

VERSION

@@ -1 +1 @@
-3.2.0
+3.3.0

salt/common/tools/sbin/so-log-check

@@ -231,7 +231,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|from NIC checksum offloading" # zeek reporter.log
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|marked for removal"           # docker container getting recycled
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|tcp 127.0.0.1:6791: bind: address already in use" # so-elastic-fleet agent restarting. Seen starting w/ 8.18.8 https://github.com/elastic/kibana/issues/201459
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-(tychon|aws_billing|microsoft_defender_endpoint|armis|o365_metrics|microsoft_sentinel|snyk|cyera|island_browser).*user so_kibana lacks the required permissions \[(logs|metrics)-\1" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user. This error should not be seen on fresh ES 9.3.3 installs or after SO 3.1.0 with soups addition of check_transform_health_and_reauthorize()
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-.*user so_kibana lacks the required permissions" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|manifest unknown"             # appears in so-dockerregistry log for so-tcpreplay following docker upgrade to 29.2.1-1
 fi
 

salt/common/tools/sbin/so-restart

@@ -35,9 +35,6 @@ case $1 in
     "elastic-fleet"|"elasticfleet")
         docker_check_running "elastic-fleet" "--stop"
         docker rm "so-elastic-fleet" 2> /dev/null
-        # Removing the elastic fleet state directory, so that the next startup re-enrolls with a fresh policy
-        rm -rf /opt/so/conf/elastic-fleet/state
-
         salt-call state.apply elasticfleet queue=True
         ;;
     *)

salt/common/tools/sbin/so-stop

@@ -29,8 +29,6 @@ case $1 in
 	"elasticfleet"|"elastic-fleet")
         docker_check_running "elastic-fleet" "--stop"
         docker rm "so-elastic-fleet" 2> /dev/null
-        # Removing the elastic fleet state directory, so that the next startup re-enrolls with a fresh policy
-        rm -rf /opt/so/conf/elastic-fleet/state
         ;;
     *)
         docker_check_running "$1" "--stop"

salt/common/tools/sbin_jinja/so-salt-minion-check

@@ -25,7 +25,7 @@ LAST_HIGHSTATE_END=$([ -e "/opt/so/log/salt/lasthighstate" ] && date -r /opt/so/
 LAST_HEALTHCHECK_STATE_APPLY=$([ -e "/opt/so/log/salt/state-apply-test" ] && date -r /opt/so/log/salt/state-apply-test +%s || echo 0)
 # SETTING THRESHOLD TO ANYTHING UNDER 600 seconds may cause a lot of salt-minion restarts since the job to touch the file occurs every 5-8 minutes by default
 # THRESHOLD is derived from the salt schedule highstate interval + 1 hour, so the minion-check grace period tracks the schedule automatically.
-THRESHOLD=$(( ({{ SCHEDULEMERGED.highstate_interval_hours }} + 1) * 3600 )) #within how many seconds the file /opt/so/log/salt/state-apply-test must have been touched/modified before the salt minion is restarted
+THRESHOLD=$(( ({{ SCHEDULEMERGED.highstate_interval_minutes }} + 60) * 60 )) #within how many seconds the file /opt/so/log/salt/state-apply-test must have been touched/modified before the salt minion is restarted
 THRESHOLD_DATE=$((LAST_HEALTHCHECK_STATE_APPLY+THRESHOLD))
 
 logCmd() {

salt/elasticfleet/enabled.sls

@@ -11,10 +11,6 @@
 
 {#   This value is generated during node install and stored in minion pillar #}
 {%   set SERVICETOKEN = salt['pillar.get']('elasticfleet:config:server:es_token','') %}
-{#   Prevent Elastic Agent from re-enrolling with a new agent.id everytime the container starts up.
-       - if a fresh enrollment is needed use 'so-stop elasticfleet'
-       #}
-{%   set ENROLLED = salt['file.file_exists']('/opt/so/conf/elastic-fleet/state/fleet.enc') %}
 
 include:
   - ca
@@ -70,7 +66,6 @@ so-elastic-fleet:
       - /etc/pki/elasticfleet-server.crt:/etc/pki/elasticfleet-server.crt:ro
       - /etc/pki/elasticfleet-server.key:/etc/pki/elasticfleet-server.key:ro
       - /etc/pki/tls/certs/intca.crt:/etc/pki/tls/certs/intca.crt:ro
-      - /opt/so/conf/elastic-fleet/state:/usr/share/elastic-agent/state
       - /opt/so/log/elasticfleet:/usr/share/elastic-agent/logs 
      {% if DOCKERMERGED.containers['so-elastic-fleet'].custom_bind_mounts %}
         {% for BIND in DOCKERMERGED.containers['so-elastic-fleet'].custom_bind_mounts %}
@@ -78,7 +73,6 @@ so-elastic-fleet:
         {% endfor %}
       {% endif %}      
     - environment:
-      {% if not ENROLLED %}
       - FLEET_SERVER_ENABLE=true
       - FLEET_URL=https://{{ GLOBALS.hostname }}:8220
       - FLEET_SERVER_ELASTICSEARCH_HOST=https://{{ GLOBALS.manager }}:9200
@@ -88,9 +82,6 @@ so-elastic-fleet:
       - FLEET_SERVER_CERT_KEY=/etc/pki/elasticfleet-server.key
       - FLEET_CA=/etc/pki/tls/certs/intca.crt     
       - FLEET_SERVER_ELASTICSEARCH_CA=/etc/pki/tls/certs/intca.crt
-      {% endif %}
-      - STATE_PATH=/usr/share/elastic-agent/state
-      - CONFIG_PATH=/usr/share/elastic-agent/state
       - LOGS_PATH=logs
       {% if DOCKERMERGED.containers['so-elastic-fleet'].extra_env %}
         {% for XTRAENV in DOCKERMERGED.containers['so-elastic-fleet'].extra_env %}
@@ -109,7 +100,6 @@ so-elastic-fleet:
       - x509: etc_elasticfleet_crt
     - require:
       - file: trusttheca
-      - file: eastatedir
       - x509: etc_elasticfleet_key
       - x509: etc_elasticfleet_crt
 

salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade

@@ -17,7 +17,7 @@ if INSTALLED_VERSION=$(elastic_fleet_package_version_check "{{ PACKAGE }}") && L
     if [ "$INSTALLED_VERSION" == "$LATEST_VERSION" ]; then
         echo "{{ PACKAGE }} integration version $INSTALLED_VERSION is already at the reported latest version $LATEST_VERSION, skipping upgrade."
     else
-        echo "Upgrading {{ PACKAGE }} package to version $LATEST_VERSION..."
+        echo "Upgrading {{ PACKAGE }} package from $INSTALLED_VERSION to version $LATEST_VERSION..."
         if ! elastic_fleet_package_install "{{ PACKAGE }}" "$LATEST_VERSION"; then
             PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
             PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")

salt/elasticsearch/defaults.yaml

@@ -3454,6 +3454,720 @@ elasticsearch:
               set_priority:
                 priority: 50
             min_age: 30d
+    so-metrics-system_x_core:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.core@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.core@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.core@custom
+        index_patterns:
+        - metrics-system.core-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.core-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_cpu:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.cpu@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.cpu@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.cpu@custom
+        index_patterns:
+        - metrics-system.cpu-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.cpu-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_diskio:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.diskio@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.diskio@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.diskio@custom
+        index_patterns:
+        - metrics-system.diskio-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.diskio-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_filesystem:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.filesystem@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.filesystem@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.filesystem@custom
+        index_patterns:
+        - metrics-system.filesystem-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.filesystem-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_fsstat:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.fsstat@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.fsstat@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.fsstat@custom
+        index_patterns:
+        - metrics-system.fsstat-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.fsstat-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_load:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.load@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.load@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.load@custom
+        index_patterns:
+        - metrics-system.load-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.load-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_memory:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.memory@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.memory@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.memory@custom
+        index_patterns:
+        - metrics-system.memory-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.memory-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_network:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.network@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.network@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.network@custom
+        index_patterns:
+        - metrics-system.network-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.network-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_ntp:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@settings
+        - metrics-system.ntp@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.ntp@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.ntp@custom
+        index_patterns:
+        - metrics-system.ntp-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.ntp-logs
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_process:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.process@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.process@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.process@custom
+        index_patterns:
+        - metrics-system.process-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.process-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_process_x_summary:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.process.summary@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.process.summary@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.process.summary@custom
+        index_patterns:
+        - metrics-system.process.summary-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.process.summary-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_socket_summary:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.socket_summary@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.socket_summary@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.socket_summary@custom
+        index_patterns:
+        - metrics-system.socket_summary-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.socket_summary-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
+    so-metrics-system_x_uptime:
+      data_stream_lifecycle:
+        data_retention: 90d
+      index_template:
+        composed_of:
+        - metrics@tsdb-settings
+        - metrics-system.uptime@package
+        - metrics@custom
+        - system@custom
+        - metrics-system.uptime@custom
+        - ecs@mappings
+        - so-fleet_integrations.ip_mappings-1
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        ignore_missing_component_templates:
+        - metrics@custom
+        - system@custom
+        - metrics-system.uptime@custom
+        index_patterns:
+        - metrics-system.uptime-*
+        priority: 501
+        template:
+          settings:
+            index:
+              lifecycle:
+                name: so-metrics-system.uptime-logs
+              mode: time_series
+              number_of_replicas: 0
+      policy:
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 30d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
     so-logs-windows_x_forwarded:
       index_sorting: false
       data_stream_lifecycle:

salt/elasticsearch/files/log4j2.properties

@@ -20,7 +20,8 @@ appender.rolling.strategy.type = DefaultRolloverStrategy
 appender.rolling.strategy.action.type = Delete
 appender.rolling.strategy.action.basepath = /var/log/elasticsearch
 appender.rolling.strategy.action.condition.type = IfFileName
-appender.rolling.strategy.action.condition.glob = *.log.gz
+# age delete regular securityonion.log.gz and gc.log.NN files
+appender.rolling.strategy.action.condition.regex = (?:.*[.]log[.]gz|gc[.]log[.][0-9]+)
 appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
 appender.rolling.strategy.action.condition.nested_condition.age = 7D
 

salt/elasticsearch/soc_elasticsearch.yaml

@@ -64,6 +64,43 @@ elasticsearch:
               flood_stage:
                 description: The max percentage of used disk space that will cause the node to take protective actions, such as blocking incoming events.
                 helpLink: elasticsearch
+      lifecycle:
+        default:
+          rollover:
+            description: This property accepts a key value pair formatted string and configures the conditions that would trigger a data stream to rollover when it has lifecycle configured.
+            forcedType: string
+            regex: ^max_age=(auto|[1-9][0-9]*[hd]),max_primary_shard_size=[1-9][0-9]*gb,min_docs=(0|[1-9][0-9]*),max_primary_shard_docs=[1-9][0-9]*$
+            regexFailureMessage: Must be in the format of "max_age=auto|<number><h|d>,max_primary_shard_size=<number>gb,min_docs=<number>,max_primary_shard_docs=<number>".
+            advanced: True
+            global: True
+    data_streams:
+      lifecycle:
+        poll_interval:
+          description: How often Elasticsearch checks what the next action is for all data streams with a built-in lifecycle.
+          forcedType: string
+          regex: "^[1-9][0-9]*[mhd]$"
+          regexFailureMessage: Must be a number followed by m, h, or d.
+          advanced: True
+          global: true
+          helpLink: elasticsearch
+        target:
+          merge:
+            policy:
+              merge_factor:
+                description: Data stream lifecycle implements tail merging by updating the Lucene merge policy factor for the target backing index. The merge factor is both the number of segments that should be merged together, and the maximum number of segments that we expect to find.
+                forcedType: int
+                regex: "^[1-9][0-9]*$"
+                advanced: True
+                global: true
+                helpLink: elasticsearch
+              floor_segment:
+                description: Data stream lifecycle implements tail merging by updating the Lucene merge policy floor segment for the target backing index. This floor segment size is a way to prevent indices from having a long tail of very small segments.
+                forcedType: string
+                regex: "^[1-9][0-9]*[MG]B$"
+                regexFailureMessage: Must be a number followed by MB or GB, such as 100MB.
+                advanced: True
+                global: true
+                helpLink: elasticsearch
     action:
       destructive_requires_name:
         description: Requires explicit index names when deleting indices. Prevents accidental deletion of indices via wildcard patterns.
@@ -645,6 +682,9 @@ elasticsearch:
             global: True
             advanced: True
             helpLink: elasticsearch
+    so-assistant-chat: *dataStreamSettings
+    so-assistant-session: *dataStreamSettings
+    so-elastic-agent-monitor: *dataStreamSettings
     so-logs-soc: *dataStreamSettings
     so-logs-system_x_auth: *dataStreamSettings
     so-logs-system_x_syslog: *dataStreamSettings
@@ -667,7 +707,10 @@ elasticsearch:
     so-logs-elastic_agent_x_auditbeat: *dataStreamSettings
     so-logs-elastic_agent_x_cloudbeat: *dataStreamSettings
     so-logs-elastic_agent_x_endpoint_security: *dataStreamSettings
+    so-logs-endpoint_x_actions: *dataStreamSettings
+    so-logs-endpoint_x_action_x_responses: *dataStreamSettings
     so-logs-endpoint_x_alerts: *dataStreamSettings
+    so-logs-endpoint_x_diagnostic_x_collection: *dataStreamSettings
     so-logs-endpoint_x_events_x_api: *dataStreamSettings
     so-logs-endpoint_x_events_x_file: *dataStreamSettings
     so-logs-endpoint_x_events_x_library: *dataStreamSettings
@@ -675,6 +718,7 @@ elasticsearch:
     so-logs-endpoint_x_events_x_process: *dataStreamSettings
     so-logs-endpoint_x_events_x_registry: *dataStreamSettings
     so-logs-endpoint_x_events_x_security: *dataStreamSettings
+    so-logs-endpoint_x_heartbeat: *dataStreamSettings
     so-logs-elastic_agent_x_filebeat: *dataStreamSettings
     so-logs-elastic_agent_x_fleet_server: *dataStreamSettings
     so-logs-elastic_agent_x_heartbeat: *dataStreamSettings
@@ -690,6 +734,19 @@ elasticsearch:
     so-metrics-vsphere_x_datastore: *dataStreamSettings
     so-metrics-vsphere_x_host: *dataStreamSettings
     so-metrics-vsphere_x_virtualmachine: *dataStreamSettings
+    so-metrics-system_x_core: *dataStreamSettings
+    so-metrics-system_x_cpu: *dataStreamSettings
+    so-metrics-system_x_diskio: *dataStreamSettings
+    so-metrics-system_x_filesystem: *dataStreamSettings
+    so-metrics-system_x_fsstat: *dataStreamSettings
+    so-metrics-system_x_load: *dataStreamSettings
+    so-metrics-system_x_memory: *dataStreamSettings
+    so-metrics-system_x_network: *dataStreamSettings
+    so-metrics-system_x_ntp: *dataStreamSettings
+    so-metrics-system_x_process: *dataStreamSettings
+    so-metrics-system_x_process_x_summary: *dataStreamSettings
+    so-metrics-system_x_socket_summary: *dataStreamSettings
+    so-metrics-system_x_uptime: *dataStreamSettings
     so-common: *dataStreamSettings
     so-endgame: *dataStreamSettings
     so-idh: *dataStreamSettings
@@ -880,17 +937,6 @@ elasticsearch:
                   global: True
                   advanced: True
                   helpLink: elasticsearch
-              rollover:
-                max_age:
-                  description: Maximum age of index.  Once an index reaches this limit, it will be rolled over into a new index.
-                  global: True
-                  advanced: True
-                  helpLink: elasticsearch
-                max_primary_shard_size:
-                  description: Maximum primary shard size. Once an index reaches this limit, it will be rolled over into a new index.
-                  global: True
-                  advanced: True
-                  helpLink: elasticsearch
               shrink:
                 method:
                   description: Shrink the index to a new index with fewer primary shards. Shrink operation is by count or size.
@@ -987,8 +1033,6 @@ elasticsearch:
             helpLink: elasticsearch
     sos-backup: *indexSettings
     so-detection: *indexSettings
-    so-assistant-chat: *indexSettings
-    so-assistant-session: *indexSettings
     so-metrics-fleet_server_x_agent_status: &fleetMetricsSettings
       index_sorting:
         description: Sorts the index by event time, at the cost of additional processing resource consumption.

salt/elasticsearch/template.map.jinja

@@ -109,9 +109,15 @@
 {%     if not settings.get('index_sorting', False) | to_bool and settings.index_template.template.settings.index.sort is defined %}
 {%       do settings.index_template.template.settings.index.pop('sort') %}
 {%     endif %}
-{%     if DATA_RETENTION_METHOD == 'DLM' and settings.index_template.data_stream is defined and settings.data_stream_lifecycle is defined %}
-{%       if settings.data_stream_lifecycle.data_retention is defined and settings.data_stream_lifecycle.data_retention %}
-{%         do settings.index_template.template.update({'lifecycle': {'data_retention': settings.data_stream_lifecycle.data_retention}}) %}
+{%     if DATA_RETENTION_METHOD == 'DLM' and settings.index_template.data_stream is defined %}
+{#       Addon defaults are generated without data_stream_lifecycle, so fall back to global defaults. #}
+{%       if settings.data_stream_lifecycle is defined %}
+{%         set DATA_STREAM_LIFECYCLE = settings.data_stream_lifecycle %}
+{%       else %}
+{%         set DATA_STREAM_LIFECYCLE = DEFAULT_GLOBAL_OVERRIDES.data_stream_lifecycle %}
+{%       endif %}
+{%       if DATA_STREAM_LIFECYCLE.data_retention is defined and DATA_STREAM_LIFECYCLE.data_retention %}
+{%         do settings.index_template.template.update({'lifecycle': {'data_retention': DATA_STREAM_LIFECYCLE.data_retention}}) %}
 {%       else %}
 {%         do settings.index_template.template.update({'lifecycle': {}}) %}
 {%       endif %}

salt/logrotate/defaults.yaml

@@ -220,6 +220,16 @@ logrotate:
       - extension .log
       - dateext
       - dateyesterday
+    /opt/so/log/salt/so-soup-grid-highstate:
+      - daily
+      - rotate 14
+      - missingok
+      - copytruncate
+      - compress
+      - create
+      - extension .log
+      - dateext
+      - dateyesterday
     /nsm/idh/*_x_log:
       - daily
       - rotate 14

salt/logrotate/soc_logrotate.yaml

@@ -140,6 +140,13 @@ logrotate:
       multiline: True
       global: True
       forcedType: "[]string"
+    "/opt/so/log/salt/so-soup-grid-highstate":
+      description: List of logrotate options for this file.
+      title: /opt/so/log/salt/so-soup-grid-highstate
+      advanced: True
+      multiline: True
+      global: True
+      forcedType: "[]string"
     "/nsm/idh/*_x_log":
       description: List of logrotate options for this file.
       title: /nsm/idh/*.log

salt/manager/tools/sbin/so-minion

@@ -138,6 +138,8 @@ function getinstallinfo() {
 		log "ERROR" "Failed to source install variables"
 		return 1
 	fi
+
+	log "INFO" "Fetched install info for $MINION_ID (node type: ${NODETYPE:-unset})"
 }
 
 function pcapspace() {
@@ -483,6 +485,7 @@ function add_sensoroni_with_analyze_to_minion() {
 
 # Sensor settings for the minion pillar
 function add_sensor_to_minion() {
+	log "INFO" "Writing sensor configuration for $MINION_ID (interface: ${INTERFACE:-unset})"
     {
         echo "sensor:"
         echo "  interface: '$INTERFACE'"
@@ -509,6 +512,8 @@ function add_sensor_to_minion() {
         log "ERROR" "Failed to add sensor configuration to $PILLARFILE"
         return 1
     fi
+
+	log "INFO" "Wrote sensor configuration for $MINION_ID"
 }
 
 function add_elastalert_to_minion() {
@@ -581,11 +586,14 @@ function add_telegraf_to_minion() {
     # generates a password on first add and is a no-op on re-add so the cred
     # is stable across repeated so-minion runs. postgres.telegraf_users on the
     # manager creates/updates the DB role from the same pillar.
-    so-telegraf-cred add "$MINION_ID"
-    if [ $? -ne 0 ]; then
-        log "ERROR" "Failed to provision postgres telegraf cred for $MINION_ID"
-        return 1
-    fi
+	log "INFO" "Provisioning postgres telegraf credential for $MINION_ID"
+	so-telegraf-cred add "$MINION_ID"
+	local result=$?
+	if [ $result -ne 0 ]; then
+		log "ERROR" "Failed to provision postgres telegraf cred for $MINION_ID (exit code: $result)"
+		return 1
+	fi
+	log "INFO" "Provisioned postgres telegraf credential for $MINION_ID"
 }
 
 function add_influxdb_to_minion() {
@@ -1043,7 +1051,7 @@ function updateMineAndApplyStates() {
 }
 
 function setupMinionFiles() {
-	log "INFO" "Setting up minion files for $MINION_ID"
+	log "INFO" "Setting up minion files for $MINION_ID (pillar: $PILLARFILE)"
 	
 	# Check to see if nodetype is set
 	if [ -z $NODETYPE ]; then
@@ -1069,7 +1077,10 @@ function setupMinionFiles() {
 	fi
 
 	# Create node-specific configuration
-	create$NODETYPE || return 1
+	create$NODETYPE || {
+		log "ERROR" "Failed to create $NODETYPE configuration for $MINION_ID"
+		return 1
+	}
 	
 	# Ensure proper ownership after all content is written
 	ensure_socore_ownership || return 1

salt/manager/tools/sbin/so-soup-grid-highstate

@@ -0,0 +1,219 @@
+#!/bin/bash
+#
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
+# so-soup-grid-highstate
+# ======================
+# Drives a batched, role-tiered highstate across every non-manager minion in the
+# grid. soup fires this (detached) after it finishes upgrading the manager so the
+# rest of the grid converges immediately instead of waiting for its own scheduled
+# highstate -- which, since the schedule moved from 15 minutes to 120 minutes
+# (salt:schedule:highstate_interval_minutes), could otherwise leave nodes on the
+# old version for up to ~2.5 hours (interval + splay) while the manager runs new code.
+#
+# Work is done by the existing orch.push_batch orchestration (salt/orch/push_batch.sls),
+# the same runner the active-push drainer uses, so batching/queueing behavior matches.
+# Tiers are dispatched in declaration order: searchnodes/heavynodes (Elasticsearch data
+# nodes) first, then receivers, then everything else -- so the data tier converges before
+# the ingest tier before sensors/fleet/idh/etc.
+#
+# When soup also upgraded Salt itself, remote minions must first highstate onto the new
+# salt-minion package (top.sls gates every real state on G@saltversion, so a stale-version
+# minion only gets salt.minion until it upgrades and reconnects). --salt-upgraded runs that
+# preliminary pass and waits for the fleet to settle before the tiered pass.
+#
+# This is best-effort: soup has already completed by the time this runs, and the 120-minute
+# scheduled highstate remains the backstop for any node that is offline or missed a batch.
+
+LOG_FILE=/opt/so/log/salt/so-soup-grid-highstate
+LOCK_FILE=/opt/so/state/so-soup-grid-highstate.lock
+SETTLE_MAX_WAIT=${GRID_HIGHSTATE_SETTLE_WAIT:-900}   # backstop for the post-salt-upgrade settle loop
+SETTLE_INTERVAL=15
+SETTLE_STABLE_CHECKS=3
+# salt-minion on an upgraded node restarts ~30s after the upgrade state runs
+# (salt/salt/minion/init.sls start_minion_post_upgrade); wait past that before sampling
+# so the settle loop sees the drop-off instead of settling on the pre-restart set.
+SETTLE_INITIAL_WAIT=${GRID_HIGHSTATE_SETTLE_INITIAL_WAIT:-45}
+
+BATCH=""
+BATCH_WAIT=""
+SALT_UPGRADED=false
+REASON="manual"
+
+log() {
+  echo "$(date '+%Y-%m-%d %H:%M:%S') | $*" | tee -a "$LOG_FILE"
+}
+
+usage() {
+  echo "Usage: so-soup-grid-highstate [--batch <spec>] [--batch-wait <sec>] [--salt-upgraded] [--reason <text>]"
+  exit 1
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --batch)        BATCH="$2"; shift 2 ;;
+    --batch-wait)   BATCH_WAIT="$2"; shift 2 ;;
+    --salt-upgraded) SALT_UPGRADED=true; shift ;;
+    --reason)       REASON="$2"; shift 2 ;;
+    -h|--help)      usage ;;
+    *)              echo "Unknown option: $1"; usage ;;
+  esac
+done
+
+mkdir -p "$(dirname "$LOG_FILE")" "$(dirname "$LOCK_FILE")"
+
+# Serialize: a second invocation (e.g. two soups, or a manual run overlapping soup's)
+# should not dispatch a competing set of batches.
+exec 9>"$LOCK_FILE"
+if ! flock -n 9; then
+  log "another so-soup-grid-highstate is already running (lock $LOCK_FILE held); exiting"
+  exit 0
+fi
+
+# Resolve batch settings from the salt:auto_apply pillar when not overridden on the
+# command line, falling back to the same defaults orch.push_batch/salt.defaults use.
+if [ -z "$BATCH" ]; then
+  BATCH=$(salt-call --out=newline_values_only pillar.get salt:auto_apply:batch 2>/dev/null)
+  [ -z "$BATCH" ] && BATCH='10%'
+fi
+if [ -z "$BATCH_WAIT" ]; then
+  BATCH_WAIT=$(salt-call --out=newline_values_only pillar.get salt:auto_apply:batch_wait 2>/dev/null)
+  [ -z "$BATCH_WAIT" ] && BATCH_WAIT=15
+fi
+
+MINIONID=$(salt-call --local --out=newline_values_only grains.get id 2>/dev/null)
+[ -z "$MINIONID" ] && MINIONID=$(cat /etc/salt/minion_id 2>/dev/null)
+if [ -z "$MINIONID" ]; then
+  log "could not determine this minion's id; aborting"
+  exit 1
+fi
+
+# Single-node grids (eval/standalone/import with no other accepted keys) have nothing
+# remote to push -- the manager already highstated during soup.
+NUM_ACCEPTED=$(salt-key --out=json --list=accepted 2>/dev/null | jq -r '.minions | length' 2>/dev/null)
+NUM_ACCEPTED=${NUM_ACCEPTED:-0}
+if [ "$NUM_ACCEPTED" -le 1 ]; then
+  log "single node grid ($NUM_ACCEPTED accepted minion(s)); nothing to push (reason=$REASON)"
+  exit 0
+fi
+
+log "starting grid highstate: reason=$REASON minion=$MINIONID accepted=$NUM_ACCEPTED batch=$BATCH batch_wait=$BATCH_WAIT salt_upgraded=$SALT_UPGRADED"
+
+# Count minions currently responsive on the bus (includes this manager).
+count_up() {
+  salt-run manage.up --out=json 2>/dev/null \
+    | python3 -c 'import sys,json; print(len(json.load(sys.stdin)))' 2>/dev/null
+}
+
+# Dispatch a single synchronous orch.push_batch run for the given actions JSON.
+# Synchronous is fine: soup launched us detached, so blocking here does not hold soup up.
+# expect_restart=true marks a dispatch (the salt-upgrade pass) where a non-zero rc is normal
+# because targets restart salt-minion mid-run -- so we don't log a misleading failure warning.
+dispatch() {
+  local desc="$1"
+  local actions="$2"
+  local expect_restart="${3:-false}"
+  local rc
+  log "dispatching $desc"
+  salt-run state.orchestrate orch.push_batch pillar="{\"actions\": $actions}" >>"$LOG_FILE" 2>&1
+  rc=$?
+  if [ "$rc" -eq 0 ]; then
+    log "$desc dispatch completed (rc=0)"
+  elif [ "$expect_restart" = "true" ]; then
+    log "$desc returned rc=$rc; this is expected during a salt upgrade (targets restart salt-minion mid-run). Waiting for them to reconnect before the tiered pass."
+  else
+    log "WARNING: $desc dispatch returned rc=$rc; nodes it missed will converge on the scheduled highstate"
+  fi
+}
+
+# Wait for the reachable minion set to recover to its pre-upgrade size and hold steady.
+# Used after the salt-upgrade pass, where targets restart salt-minion (~30s delayed, see
+# salt/salt/minion/init.sls) and drop off the bus before reconnecting on the new version.
+# target = how many minions were reachable just before the pass; requiring up >= target keeps
+# us from releasing the tiered pass while nodes are still down for their restart (settling on
+# the not-yet-restarted subset). We deliberately compare against the pre-upgrade reachable
+# count, not accepted keys, so a node an operator intentionally powered off never stalls us.
+# Bounded by SETTLE_MAX_WAIT.
+wait_for_settle() {
+  local target="$1"
+  local elapsed=0 prev=-1 stable=0 up=0
+  # Let the delayed salt-minion restart begin before we start counting stability, otherwise
+  # we could see the pre-restart set as "stable" and settle before the drop-off even happens.
+  sleep "$SETTLE_INITIAL_WAIT"
+  elapsed=$SETTLE_INITIAL_WAIT
+  while [ "$elapsed" -lt "$SETTLE_MAX_WAIT" ]; do
+    up=$(count_up); up=${up:-0}
+    if [ "$up" -ge "$target" ] && [ "$up" -eq "$prev" ]; then
+      stable=$((stable + 1))
+      [ "$stable" -ge "$SETTLE_STABLE_CHECKS" ] && break
+    else
+      stable=0
+    fi
+    prev=$up
+    sleep "$SETTLE_INTERVAL"
+    elapsed=$((elapsed + SETTLE_INTERVAL))
+  done
+  if [ "$up" -ge "$target" ]; then
+    log "fleet recovered to ${up} minions up (>= pre-upgrade ${target}) after ${elapsed}s"
+  else
+    log "WARNING: ${SETTLE_MAX_WAIT}s settle backstop hit; only ${up}/${target} pre-upgrade minions back up; proceeding (stragglers converge on the scheduled highstate)"
+  fi
+}
+
+# Pass 0: when Salt itself was upgraded, remote minions still on the old version only match
+# top.sls's 'not G@saltversion' block (salt.minion, which performs the package upgrade). Push
+# an untiered highstate so they upgrade+reconnect, then wait for them to come back before the
+# real tiered pass applies the new version's states.
+if [ "$SALT_UPGRADED" = "true" ]; then
+  PRE_UP=$(count_up); PRE_UP=${PRE_UP:-1}
+  log "pre-upgrade reachable minions (incl. this manager): $PRE_UP"
+  dispatch "salt-upgrade pass (all remote minions)" \
+    "[{\"highstate\": true, \"tgt\": \"not $MINIONID\", \"tgt_type\": \"compound\", \"batch\": \"$BATCH\", \"batch_wait\": $BATCH_WAIT}]" \
+    true
+  log "waiting for minions to reconnect on the new salt version"
+  wait_for_settle "$PRE_UP"
+fi
+
+# Tiered pass: Elasticsearch data nodes first, then receivers, then the remainder. The last
+# tier is defined as the complement of the earlier tiers (and of this manager) so coverage is
+# exhaustive -- sensors, fleet, idh, desktop, hypervisor, and any future role are all included.
+TIER_TGTS=(
+  "( *_searchnode or *_heavynode ) and not $MINIONID"
+  "*_receiver and not $MINIONID"
+  "not $MINIONID and not *_searchnode and not *_heavynode and not *_receiver"
+)
+
+# Count minions a compound target matches, using the master's key/cache data (no execution).
+tier_count() {
+  salt --out=json -C "$1" --preview-target 2>/dev/null | jq 'length' 2>/dev/null
+}
+
+# Build the actions JSON, including only tiers that actually match minions. An empty target
+# would make orch.push_batch's salt.state step return "No minions returned" -- a failure --
+# even though nothing needed to run, and grids commonly lack a tier (no receiver, etc.).
+# Keep the JSON on a single line: salt parses `pillar=<value>` kwargs with a non-DOTALL
+# regex, so an embedded newline makes it treat the whole token as a positional saltenv
+# instead ("No matching salt environment for environment 'pillar=...'").
+actions=""
+for tgt in "${TIER_TGTS[@]}"; do
+  n=$(tier_count "$tgt"); n=${n:-0}
+  if [ "$n" -ge 1 ]; then
+    [ -n "$actions" ] && actions="$actions, "
+    actions="$actions{\"highstate\": true, \"tgt\": \"$tgt\", \"tgt_type\": \"compound\", \"batch\": \"$BATCH\", \"batch_wait\": $BATCH_WAIT}"
+    log "tier matched $n minion(s): $tgt"
+  else
+    log "tier matched 0 minions, skipping: $tgt"
+  fi
+done
+
+if [ -z "$actions" ]; then
+  log "no remote minions matched any tier; nothing to push (reason=$REASON)"
+  exit 0
+fi
+dispatch "tiered pass (searchnodes/heavynodes -> receivers -> remainder)" "[$actions]"
+
+log "grid highstate complete (reason=$REASON)"
+exit 0

salt/manager/tools/sbin/soup

@@ -24,7 +24,10 @@ else
   POSTVERSION=$INSTALLEDVERSION
 fi
 INSTALLEDSALTVERSION=$(salt --versions-report | grep Salt: | awk '{print $2}')
-BATCHSIZE=5
+# Optional -b override for the grid highstate batch size (a count like "5" or a
+# percentage like "25%"). Empty means so-soup-grid-highstate uses the salt:auto_apply:batch
+# pillar default.
+BATCHSIZE=
 SOUP_LOG=/root/soup.log
 SOUP_DEBUG_LOG=/root/soup-debug.log
 WHATWOULDYOUSAYYAHDOHERE=soup
@@ -442,10 +445,41 @@ get_soup_script_hashes() {
 }
 
 highstate() {
-  # Run a highstate.
+  # Run a highstate with a retry attempt.
+  if salt-call state.highstate -l info queue=True; then
+    return 0
+  fi
+
+  echo "Initial highstate attempt had a problem; retrying in 30 seconds."
+  sleep 30
   salt-call state.highstate -l info queue=True
 }
 
+push_grid_highstate() {
+  # Drive a batched, role-tiered highstate across the rest of the grid so remote minions
+  # pick up this upgrade now instead of waiting up to ~2.5 hours for their own scheduled
+  # highstate (the schedule moved from 15 to 120 minutes). so-soup-grid-highstate does the work
+  # via orch.push_batch; it only exists once the manager highstate has deployed this
+  # version's sbin files, so guard on it. Launch fully detached (setsid) so it survives an
+  # SSH drop, and never let it affect soup's exit status -- it is best-effort with the
+  # scheduled highstate as backstop.
+  if [[ ! -x /usr/sbin/so-soup-grid-highstate ]]; then
+    echo "so-soup-grid-highstate not present; remote nodes will converge on their scheduled highstate."
+    return 0
+  fi
+
+  local extra_args=()
+  if [[ $SALTUPGRADED == true || $UPGRADESALT -eq 1 ]]; then
+    extra_args+=(--salt-upgraded)
+  fi
+  if [[ -n "$BATCHSIZE" ]]; then
+    extra_args+=(--batch "$BATCHSIZE")
+  fi
+
+  echo "Dispatching a grid-wide highstate to remote nodes. Progress: /opt/so/log/salt/so-soup-grid-highstate"
+  setsid nohup /usr/sbin/so-soup-grid-highstate --reason soup "${extra_args[@]}" >/dev/null 2>&1 &
+}
+
 masterlock() {
   echo "Locking Salt Master"
   mv -v $TOPFILE $BACKUPTOPFILE
@@ -473,6 +507,7 @@ preupgrade_changes() {
     [[ "$INSTALLEDVERSION" =~ ^2\.4\.21[0-9]+$ ]] && up_to_3.0.0
     [[ "$INSTALLEDVERSION" == "3.0.0" ]] && up_to_3.1.0
     [[ "$INSTALLEDVERSION" == "3.1.0" ]] && up_to_3.2.0
+    [[ "$INSTALLEDVERSION" == "3.2.0" ]] && up_to_3.3.0
     true
 }
 
@@ -490,6 +525,7 @@ postupgrade_changes() {
     [[ "$POSTVERSION" =~ ^2\.4\.21[0-9]+$ ]] && post_to_3.0.0
     [[ "$POSTVERSION" == "3.0.0" ]] && post_to_3.1.0
     [[ "$POSTVERSION" == "3.1.0" ]] && post_to_3.2.0
+    [[ "$POSTVERSION" == "3.2.0" ]] && post_to_3.3.0
     # All applicable post-upgrade steps completed; clear the resume marker.
     rm -f "$POSTVERSION_FILE"
     true
@@ -872,7 +908,7 @@ post_to_3.1.0() {
 recollate_postgres() {
   echo ""
   echo "Recollating PostgreSQL databases. The following output may contain warnings about a version mismatch, followed by a note indicating that the collation version has been changed."
-  for db in postgres securityonion so_telegraf; do
+  for db in template1 postgres securityonion so_telegraf; do
     docker exec so-postgres psql -U postgres $db -c "reindex database $db"
     docker exec so-postgres psql -U postgres $db -c "alter database $db refresh collation version"
   done
@@ -974,6 +1010,10 @@ up_to_3.2.0() {
 
   pin_elasticsearch_data_retention_method
 
+  # Run so-elastic-fleet-es-url update with --force to ensure eval/import have
+  #  configured so-manager_elasicsearch as the default output for both monitoring and logs
+  /usr/sbin/so-elastic-fleet-es-url-update --force
+
   INSTALLEDVERSION=3.2.0
 }
 
@@ -994,9 +1034,19 @@ post_to_3.2.0() {
 
   set_postversion 3.2.0
 }
-
 ### 3.2.0 End ###
 
+### 3.2.0 Scripts ###
+up_to_3.3.0() {
+  INSTALLEDVERSION=3.3.0
+}
+
+post_to_3.3.0() {
+  # Recollate again since some internal DBs were excluded during 3.2.0 soup
+  recollate_postgres
+}
+### 3.3.0 End ###
+
 
 repo_sync() {
   echo "Sync the local repo."
@@ -1926,6 +1976,9 @@ main() {
     # rather than reporting "already latest". The soversion/pillar writes in
     # update_version are no-ops here since the version is unchanged for a hotfix.
     update_version
+    # Push the hotfix out to the rest of the grid rather than waiting for the scheduled
+    # highstate. Hotfixes never upgrade Salt, so no --salt-upgraded pass is needed.
+    push_grid_highstate
   else
     SOUP_UPGRADE_STARTED=true
     echo ""
@@ -2092,13 +2145,18 @@ main() {
 
     if [[ $NUM_MINIONS -gt 1 ]]; then
 
+      # Actively drive the rest of the grid to this version now. The scheduled highstate
+      # runs only every 120 minutes (salt:schedule:highstate_interval_minutes), so without
+      # this remote nodes could sit on the old version for a couple of hours after soup finishes.
+      push_grid_highstate
+
       cat << EOF
 
 
 
-This appears to be a distributed deployment. Other nodes should update themselves at the next Salt highstate (typically within 15 minutes). Do not manually restart anything until you know that all the search/heavy nodes in your deployment are updated. This is especially important if you are using true clustering for Elasticsearch.
+This appears to be a distributed deployment. soup has dispatched a batched, grid-wide highstate to update the other nodes now: Elasticsearch data nodes (search/heavynodes) first, then receivers, then sensors and the remaining nodes. Progress is logged to /opt/so/log/salt/so-soup-grid-highstate, and you can watch nodes update from the Grid section of SOC. Do not manually restart anything until you know that all the search/heavynodes in your deployment are updated. This is especially important if you are using true clustering for Elasticsearch.
 
-Each minion is on a random 15 minute check-in period and things like network bandwidth can be a factor in how long the actual upgrade takes. If you have a heavy node on a slow link, it is going to take a while to get the containers to it. Depending on what changes happened between the versions, Elasticsearch might not be able to talk to said heavy node until the update is complete.
+Nodes are updated in batches, and things like network bandwidth can be a factor in how long the actual upgrade takes. If you have a heavy node on a slow link, it is going to take a while to get the containers to it. Depending on what changes happened between the versions, Elasticsearch might not be able to talk to said heavy node until the update is complete. Any node that is offline or missed a batch will converge on its own scheduled highstate (every 120 minutes by default).
 
 If it looks like you’re missing data after the upgrade, please avoid restarting services and instead make sure at least one search node has completed its upgrade. The best way to do this is to run 'sudo salt-call state.highstate' from a search node and make sure there are no errors. Typically if it works on one node it will work on the rest. Sensor nodes are less complex and will update as they check in so you can monitor those from the Grid section of SOC.
 
@@ -2138,8 +2196,10 @@ while getopts ":b:f:y" opt; do
   case ${opt} in
     b )
       BATCHSIZE="$OPTARG"
-      if ! [[ "$BATCHSIZE" =~ ^[1-9][0-9]*$ ]]; then
-        echo "Batch size must be a number greater than 0."
+      # Accept either a plain count (e.g. 5) or a percentage (e.g. 25%); passed through
+      # to so-soup-grid-highstate --batch, which salt's batch/batch_wait accepts in both forms.
+      if ! [[ "$BATCHSIZE" =~ ^[1-9][0-9]*%?$ ]]; then
+        echo "Batch size must be a number greater than 0, optionally with a trailing % (e.g. 5 or 25%)."
         exit 1
       fi
     ;;

salt/nginx/etc/nginx.conf

@@ -96,14 +96,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	referrer-Policy             no-referrer;
+		add_header 	Referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve secp521r1:secp384r1;
+		ssl_ecdh_curve X25519:secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
 	}
@@ -138,14 +138,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	referrer-Policy             no-referrer;
+		add_header 	Referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve secp521r1:secp384r1;
+		ssl_ecdh_curve X25519:secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
         location / {
@@ -172,14 +172,14 @@ http {
 		add_header 	X-XSS-Protection            "1; mode=block";
 		add_header 	X-Content-Type-Options      nosniff;
 		add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
-		add_header 	referrer-Policy             no-referrer;
+		add_header 	Referrer-Policy             no-referrer;
 
 		ssl_certificate "/etc/pki/nginx/server.crt";
 		ssl_certificate_key "/etc/pki/nginx/server.key";
 		ssl_session_cache shared:SSL:1m;
 		ssl_session_timeout  10m;
 		ssl_ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_CCM:TLS_RSA_WITH_ARIA_256_GCM_SHA384:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_128_CCM:TLS_RSA_WITH_ARIA_128_GCM_SHA256;
-		ssl_ecdh_curve secp521r1:secp384r1;
+		ssl_ecdh_curve X25519:secp521r1:secp384r1;
 		ssl_prefer_server_ciphers on;
 		ssl_protocols TLSv1.2 TLSv1.3;
 
@@ -198,6 +198,10 @@ http {
 		}
 
 		location / {
+			if ($http_authorization ~* "^Bearer .*$") {
+				return 401;
+			}
+
 			auth_request            /auth/sessions/whoami;
 			auth_request_set        $userid $upstream_http_x_kratos_authenticated_identity_id;
 			proxy_set_header        x-user-id $userid;
@@ -218,6 +222,13 @@ http {
 			add_header              Cache-Control "no-cache, no-store, must-revalidate";
 			add_header              Pragma "no-cache";
 			add_header              Expires "0";
+
+			add_header 	Content-Security-Policy     "default-src 'self' 'unsafe-inline' 'unsafe-eval' https: data: blob: wss:; frame-ancestors 'self'";
+			add_header 	X-Frame-Options             SAMEORIGIN;
+			add_header 	X-XSS-Protection            "1; mode=block";
+			add_header 	X-Content-Type-Options      nosniff;
+			add_header 	Strict-Transport-Security   "max-age=31536000; includeSubDomains";
+			add_header 	Referrer-Policy             no-referrer;
 		}
 
 		location ~ ^/auth/.*?(login|oidc/callback) {
@@ -383,6 +394,11 @@ http {
 			if ($http_authorization = "") {
 				return 403;
 			}
+
+			if ($http_authorization ~* "^Bearer .*$") {
+				return 401;
+			}
+
 			proxy_pass            http://{{ GLOBALS.manager }}:9822/;
 			proxy_read_timeout    90;
 			proxy_connect_timeout 90;
@@ -399,7 +415,7 @@ http {
 		error_page 429 = @error429;
 
 		location @error401 {
-			if ($request_uri ~* (^.*/api/.*|^/connect/.*|^/oauth2/.*|^/.*\.map$)) {
+			if ($request_uri ~* (^.*/api/.*|^.*/login.*|^.*/logout.*|^/connect/.*|^/oauth2/.*|^/.*\.map$)) {
 				return    401;
 			}
 

salt/reactor/pillar_push_map.yaml

@@ -242,7 +242,7 @@ versionlock:
 # grain (compound supports nested grain matching via G@<key>:<subkey>:<value>).
 # pillar/vm/soc_vm.sls write path is referenced at salt/_runners/setup_hypervisor.py:856.
 vm:
-  - state: vm
+  - state: vm.user
     tgt: 'G@salt-cloud:driver:libvirt'
 
 # zeek: sensor_roles + so-import (5 roles).

salt/repo/client/oracle.sls

@@ -60,6 +60,9 @@ so_repo:
   {% endif %}
     - enabled: 1
     - gpgcheck: 1
+  {% if not GLOBALS.is_manager %}
+    - sslverify: 0
+  {% endif %}
 
 # Only assign the kernel repo once this node's running salt matches the version this
 # SO release ships. During a soup the grid is mid-salt-upgrade; gating here keeps the
@@ -77,6 +80,9 @@ so_kernel_repo:
   {% endif %}
     - enabled: 1
     - gpgcheck: 1
+  {% if not GLOBALS.is_manager %}
+    - sslverify: 0
+  {% endif %}
     # Supplementary kernel repo: tolerate it being empty/unreachable (e.g. before the
     # manager has populated /nsm/kernelrepo) so a missing repomd.xml can't make every
     # dnf/pkg operation on the grid fail.

salt/salt/defaults.yaml

@@ -3,7 +3,7 @@ salt:
     enabled: true
     debounce_seconds: 30
     drain_interval: 15
-    batch: '25%'
+    batch: '10%'
     batch_wait: 15
   schedule:
-    highstate_interval_hours: 2
+    highstate_interval_minutes: 120

salt/salt/highstate_schedule.sls

@@ -1,11 +1,15 @@
 {% from 'vars/globals.map.jinja' import GLOBALS %}
 {% from 'salt/schedule.map.jinja' import SCHEDULEMERGED %}
 
+{# splay a quarter of the interval, clamped to [5 min, 30 min], so short intervals
+   don't get jitter larger than the interval itself #}
+{% set SPLAY = [[(SCHEDULEMERGED.highstate_interval_minutes * 60 // 4) | int, 300] | max, 1800] | min %}
+
 highstate_schedule:
   schedule.present:
     - function: state.highstate
-    - hours: {{ SCHEDULEMERGED.highstate_interval_hours }}
+    - minutes: {{ SCHEDULEMERGED.highstate_interval_minutes }}
     - maxrunning: 1
 {% if not GLOBALS.is_manager %}
-    - splay: 1800
+    - splay: {{ SPLAY }}
 {% endif %}

salt/salt/soc_salt.yaml

@@ -31,9 +31,11 @@ salt:
       global: True
       advanced: True
   schedule:
-    highstate_interval_hours:
-      description: How often every minion in the grid runs a scheduled state.highstate, in hours. Lower values keep minions closer in sync at the cost of more load; higher values reduce load but increase worst-case latency for non-pushed changes. The salt-minion health check restarts a minion if its last highstate is older than this value plus one hour.
+    highstate_interval_minutes:
+      description: How often every minion in the grid runs a scheduled state.highstate, in minutes. Minimum 15 minutes. Lower values keep minions closer in sync at the cost of more load; higher values reduce load but increase worst-case latency for non-pushed changes. If Auto Apply is disabled, set this to the 15-minute minimum so changes are still picked up promptly. The salt-minion health check restarts a minion if its last state apply is older than this value plus one hour.
       forcedType: int
       helpLink: push
       global: True
       advanced: True
+      regex: '^(1[5-9]|[2-9][0-9]|[1-9][0-9]{2,4})$'
+      regexFailureMessage: The value must be an integer of at least 15 minutes (maximum 99999).

salt/soc/defaults.yaml

@@ -36,8 +36,8 @@ soc:
         icon: fa-stream
         target: ''
         links:
-          - '/joblookup?esid={:soc_id}&time={:@timestamp}&gridId={gridId}'
-          - '/joblookup?ncid={:network.community_id}&time={:@timestamp}&gridId={gridId}'
+          - '/api/joblookup?esid={:soc_id}&time={:@timestamp}&gridId={gridId}'
+          - '/api/joblookup?ncid={:network.community_id}&time={:@timestamp}&gridId={gridId}'
         categories:
           - hunt
           - alerts
@@ -1512,6 +1512,10 @@ soc:
                 rulesetName: sos-resources-ag
                 branch: main
                 folder: securityonion-normalized
+              - repo: file:///nsm/airgap-resources/playbooks/securityonion-resources-playbooks
+                rulesetName: sos-published-ag
+                branch: published
+                folder: sigma
         assistant:
           systemPromptAddendum: ""
           systemPromptAddendumMaxLength: 50000
@@ -1530,9 +1534,9 @@ soc:
               healthTimeoutSeconds: 5
           agentic: false
           agentMapping:
-            Orchestrator: Claude Sonnet
-            Investigator: Claude Sonnet
-            Detection Engineer: Claude Sonnet
+            Orchestrator: sonnet@SOAI
+            Investigator: gemma@SOAI
+            DetectionEngineer: gemma@SOAI
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false
@@ -2714,4 +2718,14 @@ soc:
               enabled: true
               adapter: SOAI
               charsPerTokenEstimate: 4
+            - id: gemma
+              displayName: Gemma
+              origin: USA
+              contextLimitSmall: 256000
+              contextLimitLarge: 256000
+              lowBalanceColorAlert: 500000
+              enabled: true
+              adapter: SOAI
+              charsPerTokenEstimate: 4
+              
             

salt/soc/files/soc/sigma_playbook_pipeline.yaml

@@ -12,6 +12,30 @@ transformations:
         process.command_line: process.command_line.caseless
         process.parent.command_line: process.parent.command_line.caseless
         file.path: file.path.caseless
+    # entity_id pivots must also match processes that were already running when the
+    # agent started: Defend emits already_running (event.type:info), not start.
+    # Kept out of Playbook sigma query because Sysmon has no equivalent concept.
+    # contains_field is exact, so child pivots (process.parent.entity_id) stay
+    # start-only. Drop must precede add;
+    - id: playbook_process_lifecycle_drop_start_scope
+      type: drop_detection_item
+      field_name_conditions:
+        - type: include_fields
+          fields: ['event.type']
+      rule_conditions:
+        - type: logsource
+          category: process_creation
+        - type: contains_field
+          field: process.entity_id
+    - id: playbook_process_lifecycle_add-fields
+      type: add_condition
+      conditions:
+        event.type: ['start', 'info']
+      rule_conditions:
+        - type: logsource
+          category: process_creation
+        - type: contains_field
+          field: process.entity_id
     # file_activity: playbook-only pseudo-category spanning all file operations.
     - id: playbook_file_activity_add-fields
       type: add_condition

salt/soc/files/soc/sigma_so_pipeline.yaml

@@ -46,31 +46,47 @@ transformations:
       - type: logsource
         product: opencanary
     # Maps "antivirus" category to Windows Defender logs shipped by Elastic Agent Winlog Integration
+    # and to Elastic Defend malware alerts
     # winlog.event_data.threat_name has to be renamed prior to ingestion, it is originally winlog.event_data.Threat Name
-    - id: antivirus_field-mappings_windows-defender
+    - id: antivirus_field-mappings
       type: field_name_mapping
       mapping:
-        Signature: winlog.event_data.threat_name
+        Signature:
+          - winlog.event_data.threat_name
+          - rule.name
       rule_conditions:
       - type: logsource
         category: antivirus
-    - id: antivirus_add-fields_windows-defender
+    - id: antivirus_add-fields
       type: add_condition
       conditions:
-        winlog.channel: 'Microsoft-Windows-Windows Defender/Operational'
-        winlog.provider_name: 'Microsoft-Windows-Windows Defender'
-        event.code: "1116"
+        event.code:
+          - "1116"
+          - "malicious_file"
+          - "memory_signature"
       rule_conditions:
       - type: logsource
         category: antivirus
     # OS-agnostic process_creation scoping for product-less (NIDS/host-pivot) rules.
+    # pySigma: rule_cond_expr requires rule_conditions as a mapping, not a list.
     - id: process_creation_os_agnostic
       type: add_condition
       conditions:
         event.category: process
       rule_conditions:
-      - type: logsource
-        category: process_creation
+        pc_cat:
+          type: logsource
+          category: process_creation
+        pc_win:
+          type: logsource
+          product: windows
+        pc_mac:
+          type: logsource
+          product: macos
+        pc_lin:
+          type: logsource
+          product: linux
+      rule_cond_expr: "pc_cat and not (pc_win or pc_mac or pc_lin)"
     # Transforms the `Hashes` field to ECS fields
     # ECS fields are used by the hash fields emitted by Elastic Defend
     # If shipped with Elastic Agent, sysmon logs will also have hashes mapped to ECS fields    
@@ -626,4 +642,4 @@ transformations:
         tags: '*file'
       rule_conditions:
       - type: logsource
-        category: file
+        category: file

salt/soc/soc_soc.yaml

@@ -786,7 +786,7 @@ soc:
             Investigator:
               description: This agent investigates alerts, explains events and records, and hunts through event data. It can also acknowledge alerts and escalate to cases.
               global: True
-            Detection Engineer:
+            DetectionEngineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
       client:

salt/zeek/defaults.yaml

@@ -62,7 +62,6 @@ zeek:
         - securityonion/file-extraction
         - securityonion/community-id-extended
         - oui-logging
-        - icsnpp-modbus
         - icsnpp-dnp3
         - icsnpp-bacnet
         - icsnpp-ethercat

setup/so-functions

@@ -971,8 +971,8 @@ docker_seed_registry() {
 	if [ -f /nsm/docker-registry/docker/registry.tar ]; then
 		logCmd "tar xvf /nsm/docker-registry/docker/registry.tar -C /nsm/docker-registry/docker"
 		logCmd "rm /nsm/docker-registry/docker/registry.tar"
-	elif [ -d /nsm/docker-registry/docker/registry ] && [ -f /etc/SOCLOUD ]; then
-		echo "Using existing docker registry content for cloud install"
+	elif [[ -d /nsm/docker-registry/docker/registry && ( -f /etc/SOCLOUD || "$is_airgap" == true ) ]]; then
+		echo "Using existing docker registry content"
 	else
 		if [ "$install_type" == 'IMPORT' ]; then
 			container_list 'so-import'