Add custom_bind_mounts to so-kafka and so-soc

Every container in docker/defaults.yaml exposes custom_bind_mounts via
soc_docker.yaml, but kafka and soc enabled.sls never appended them to
binds, so the setting was silently ignored for those two containers.

salt/kafka/enabled.sls

@@ -61,6 +61,11 @@ so-kafka:
       {% if KAFKA_EXTERNAL_ACCESS %}
       - /opt/so/conf/kafka/kafka_server_jaas.conf:/opt/kafka/config/kafka_server_jaas.conf:ro
       {% endif %}
+      {% if DOCKERMERGED.containers['so-kafka'].custom_bind_mounts %}
+        {% for BIND in DOCKERMERGED.containers['so-kafka'].custom_bind_mounts %}
+      - {{ BIND }}
+        {% endfor %}
+      {% endif %}
     {% if DOCKERMERGED.containers['so-kafka'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-kafka'].ulimits %}

salt/soc/defaults.yaml

@@ -1545,6 +1545,7 @@ soc:
             Investigator: haiku@SOAI
             DetectionEngineer: haiku@SOAI
             AlertTriage: haiku@SOAI
+            Notifier: haiku@SOAI
           useMemory: false
           useMemoryScanner: false
           dontScanBefore: ""
@@ -2526,9 +2527,6 @@ soc:
           queries:
             - name: 'Group By Name, Module'
               query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
-            - name: 'Group By Assessment, Name'
-              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
-              license: oai
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
               query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
             - name: 'Group By Source IP, Name'

salt/soc/enabled.sls

@@ -62,6 +62,11 @@ so-soc:
       - /nsm/backup/detections-migration:/nsm/backup/detections-migration:ro
       - /opt/so/state:/opt/so/state:rw
       - /etc/pki/tls/certs/intca.crt:/opt/sensoroni/html/so-ca.crt:ro
+      {% if DOCKERMERGED.containers['so-soc'].custom_bind_mounts %}
+        {% for BIND in DOCKERMERGED.containers['so-soc'].custom_bind_mounts %}
+      - {{ BIND }}
+        {% endfor %}
+      {% endif %}
     - extra_hosts:
     {% for node in DOCKER_EXTRA_HOSTS %}
     {%   for hostname, ip in node.items() %}

salt/soc/merged.map.jinja

@@ -22,25 +22,6 @@
 {% do SOCMERGED.config.server.update({'additionalCA': MANAGERMERGED.additionalCA}) %}
 {% do SOCMERGED.config.server.update({'insecureSkipVerify': MANAGERMERGED.insecureSkipVerify}) %}
 
-{# pillar.get replaces lists instead of merging them, so combine availableModels by id #}
-{% set default_models = {} %}
-{% for m in SOCDEFAULTS.config.server.client.assistant.availableModels %}
-{%   do default_models.setdefault(m.id, m) %}
-{% endfor %}
-{% set merged_models = [] %}
-{% set merged_ids = [] %}
-{% for m in SOCMERGED.config.server.client.assistant.availableModels or [] %}
-{%   set model = {} %}
-{%   do model.update(default_models.get(m.get('id'), {})) %}
-{%   do model.update(m) %}
-{%   do merged_models.append(model) %}
-{%   do merged_ids.append(m.get('id')) %}
-{% endfor %}
-{% for id, m in default_models.items() if id not in merged_ids %}
-{%   do merged_models.append(m) %}
-{% endfor %}
-{% do SOCMERGED.config.server.client.assistant.update({'availableModels': merged_models}) %}
-
 {% if not SOCMERGED.config.server.modules.postgres.host %}
 {%   do SOCMERGED.config.server.modules.postgres.update({'host': GLOBALS.manager}) %}
 {% endif %}

salt/soc/soc_soc.yaml

@@ -954,7 +954,10 @@ soc:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
             AlertTriage:
-              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can send a notification but cannot acknowledge alerts or escalate to cases.
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
+              global: True
+            Notifier:
+              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
               global: True
           useMemory:
             description: Enables the Memory system for OnionAI
@@ -1226,8 +1229,6 @@ soc:
             - field: showSubtitle
               label: Show Query in Dropdown.
               forcedType: bool
-            - field: license
-              label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere.
           queryToggleFilters:
             description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.
             global: True