Merge pull request #16335 from Security-Onion-Solutions/esql-default-query

Refactor correlation template

salt/soc/defaults.yaml

@@ -1571,6 +1571,7 @@ soc:
             tickIntervalSeconds: 60
             maxConcurrentItems: 4
             maxQueuedItems: 0
+            turnTimeoutSeconds: 300
             alertTriageEpoch: "2026-09-24T00:00:00Z"
           tools:
             filterEventFields:
@@ -2808,6 +2809,10 @@ soc:
               # Sigma correlation rule; requires ES|QL (useEsql).
               # First document: the correlation. Following documents: the rules it references.
               #
+              # This example mirrors the shipped rule c448c9f6 (Repeated SOC Login Failures For One Account).
+              # Change it before enabling, or you will get two alerts for the same activity.
+              # To test: log out of SOC and enter a wrong password 5 times for one username.
+              #
               # Types: event_count, value_count, temporal, value_sum, value_avg, value_median, value_percentile.
               # Correlation Guide: https://sigmahq.io/docs/meta/correlations.html
               # Logsources: https://sigmahq.io/docs/basics/log-sources.html
@@ -2816,46 +2821,45 @@ soc:
               id: [publicId]
               status: 'experimental'
               description: |
-                  Describe what the correlation finds and, importantly, why relating these
+                  Describe what the correlation finds and why relating these events is more
-                  events is more meaningful than either of them alone.
+                  meaningful than any one of them alone.
+                  Example: 5 or more failed SOC logins for one username in 10 minutes.
               references:
-                - 'https://local.invalid'
+                - 'https://attack.mitre.org/techniques/T1110/001/'
               author: '@SecurityOnion'
               date: '[today]'
               tags:
-                - detection.threat_hunting
+                - attack.credential-access
-                - attack.technique_id
+                - attack.t1110.001
               correlation:
-                  type: value_count
+                  type: event_count       # count the base rule's events...
                   rules:
-                      - example_base_rule  # the 'name' of the rule below
+                      - example_base_rule # ...by the 'name' of the rule below
                   group-by:
-                      - source.ip
+                      - user.name         # ...separately for each username
-                  # Xs, Xm, Xh, Xd or Xw.
+                  timespan: 10m           # Xs, Xm, Xh
-                  timespan: 10m
                   condition:
-                      field: dns.query.name
+                      gte: 5
-                      gte: 40
               falsepositives:
-                - 'Describe the benign activity that also produces this pattern'
+                - 'A user entering an old password after a password change'
               # Placeholders: %count%, %start%, %end%, %duration%, or any field.
-              summary: '%count% distinct names queried by %source.ip% in %duration%'
+              summary: '%count% failed SOC logins for %user.name% in %duration%, from %http.request.headers.x-real-ip%'
               level: 'medium'  # info | low | medium | high | critical
               ---
-              title: 'Base Event'
+              title: 'SOC Login Failure'
               # referenced by 'name' (or 'id')
               name: example_base_rule
-              description: 'The single event that the correlation aggregates.'
+              description: 'One failed SOC login. Put filters here, not in the correlation.'
               logsource:
-                category: network
+                product: kratos
-                service: dns
+                service: application
               detection:
                   selection:
-                      dns.query.name|exists: true
+                      msg: 'Encountered self-service login error.'
                   condition: selection
               # Carried into the alert.
               fields:
-                - dns.query.name
+                - http.request.headers.x-real-ip
         assistant:
           enabled: false
           investigationPrompt: Investigate Alert ID {socId}

salt/soc/merged.map.jinja

@@ -22,7 +22,7 @@
 {% do SOCMERGED.config.server.update({'additionalCA': MANAGERMERGED.additionalCA}) %}
 {% do SOCMERGED.config.server.update({'insecureSkipVerify': MANAGERMERGED.insecureSkipVerify}) %}
 
-{# pillar.get replaces lists instead of merging them, so combine availableModels by id #}
+{# pillar.get replaces lists instead of merging them, so combine availableModels by id and alerts queries by name #}
 {% set default_models = {} %}
 {% for m in SOCDEFAULTS.config.server.client.assistant.availableModels %}
 {%   do default_models.setdefault(m.id, m) %}
@@ -41,6 +41,24 @@
 {% endfor %}
 {% do SOCMERGED.config.server.client.assistant.update({'availableModels': merged_models}) %}
 
+{% set default_queries = {} %}
+{% for q in SOCDEFAULTS.config.server.client.alerts.queries %}
+{%   do default_queries.setdefault(q.name, q) %}
+{% endfor %}
+{% set merged_queries = [] %}
+{% set merged_names = [] %}
+{% for q in SOCMERGED.config.server.client.alerts.queries or [] %}
+{%   set query = {} %}
+{%   do query.update(default_queries.get(q.get('name'), {})) %}
+{%   do query.update(q) %}
+{%   do merged_queries.append(query) %}
+{%   do merged_names.append(q.get('name')) %}
+{% endfor %}
+{% for name, q in default_queries.items() if name not in merged_names %}
+{%   do merged_queries.append(q) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.alerts.update({'queries': merged_queries}) %}
+
 {% if not SOCMERGED.config.server.modules.postgres.host %}
 {%   do SOCMERGED.config.server.modules.postgres.update({'host': GLOBALS.manager}) %}
 {% endif %}

salt/soc/soc_soc.yaml

@@ -1058,11 +1058,18 @@ soc:
               global: True
               advanced: True
               forcedType: int
+            turnTimeoutSeconds:
+              description: Maximum number of seconds a single model turn of an automation's agent session may run, even while the model is still producing output. A turn that exceeds this limit is abandoned and the session is recorded as failed. Set to 0 to disable the timeout. Edit this setting via the Agent Studio.
+              global: True
+              advanced: True
+              forcedType: int
+              readonlyUi: True
             alertTriageEpoch:
               description: The earliest alert time the Alert Triage automation will consider. Alerts before this time are never triaged, which keeps a first run on an existing deployment from working through old history. Must be in UTC format (2026-09-24T00:00:00Z).
               regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'
               regexFailureMessage: Expecting date in RFC3339 format (2026-09-24T00:00:00Z)
               global: True
+              readonlyUi: True
               advanced: True
           tools:
             filterEventFields: