Change readonly to readonlyUi in YAML configuration

Merge pull request #16331 from Security-Onion-Solutions/TOoSmOotH-patch-5
Add readonly attribute to earliest alert time field
2026-10-16 19:26:23 +02:00 · 2026-10-15 11:39:59 -04:00 · 2026-10-15 11:19:58 -04:00 · 2026-10-15 11:16:48 -04:00 · 2026-10-14 11:13:39 -04:00 · 2026-10-14 09:19:16 -04:00
2 changed files with 20 additions and 1 deletions
@@ -22,7 +22,7 @@
 {% do SOCMERGED.config.server.update({'additionalCA': MANAGERMERGED.additionalCA}) %}
 {% do SOCMERGED.config.server.update({'insecureSkipVerify': MANAGERMERGED.insecureSkipVerify}) %}

-{# pillar.get replaces lists instead of merging them, so combine availableModels by id #}
+{# pillar.get replaces lists instead of merging them, so combine availableModels by id and alerts queries by name #}
 {% set default_models = {} %}
 {% for m in SOCDEFAULTS.config.server.client.assistant.availableModels %}
 {%   do default_models.setdefault(m.id, m) %}
@@ -41,6 +41,24 @@
 {% endfor %}
 {% do SOCMERGED.config.server.client.assistant.update({'availableModels': merged_models}) %}

+{% set default_queries = {} %}
+{% for q in SOCDEFAULTS.config.server.client.alerts.queries %}
+{%   do default_queries.setdefault(q.name, q) %}
+{% endfor %}
+{% set merged_queries = [] %}
+{% set merged_names = [] %}
+{% for q in SOCMERGED.config.server.client.alerts.queries or [] %}
+{%   set query = {} %}
+{%   do query.update(default_queries.get(q.get('name'), {})) %}
+{%   do query.update(q) %}
+{%   do merged_queries.append(query) %}
+{%   do merged_names.append(q.get('name')) %}
+{% endfor %}
+{% for name, q in default_queries.items() if name not in merged_names %}
+{%   do merged_queries.append(q) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.alerts.update({'queries': merged_queries}) %}
+
 {% if not SOCMERGED.config.server.modules.postgres.host %}
 {%   do SOCMERGED.config.server.modules.postgres.update({'host': GLOBALS.manager}) %}
 {% endif %}
@@ -1063,6 +1063,7 @@ soc:
              regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'
              regexFailureMessage: Expecting date in RFC3339 format (2026-09-24T00:00:00Z)
              global: True
+              readonlyUi: True
              advanced: True
          tools:
            filterEventFields:
Author	SHA1	Message	Date
Mike Reeves	da25083837	Change readonly to readonlyUi in YAML configuration	2026-10-15 11:39:59 -04:00
Mike Reeves	76fb1cc479	Merge pull request #16331 from Security-Onion-Solutions/TOoSmOotH-patch-5 Add readonly attribute to earliest alert time field	2026-10-15 11:19:58 -04:00
Mike Reeves	cfb8992a92	Add readonly attribute to earliest alert time field	2026-10-15 11:16:48 -04:00
Josh Patterson	7121531336	Merge pull request #16328 from Security-Onion-Solutions/fix/socqeurymerge combine default and alerts queries added via pillar	2026-10-14 11:13:39 -04:00
Josh Patterson	ff2b46b73e	combine default and alerts queries added via pillar pillar.get replaces lists, so once alerts queries are saved to pillar from the SOC config UI, queries added to defaults later (e.g. the licensed Group By Assessment, Name) never reach soc.json. Merge them by name the same way availableModels are merged by id: pillar order and edits are kept, and default queries missing from pillar are appended.	2026-10-14 09:19:16 -04:00
Mike Reeves	b158a38099	Merge pull request #16323 from Security-Onion-Solutions/mreeves/alert-triage-notify-skill Remove the Notifier agent mapping	2026-10-13 17:45:22 -04:00