Update version from 3.4.0 to 3.0.0-foxtrot

2026-10-11 16:59:32 +02:00 · 2026-10-06 11:27:02 -05:00
8 changed files with 21 additions and 49 deletions
@@ -1 +1 @@
-3.4.0
+3.0.0-foxtrot
@@ -178,7 +178,6 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Missing ory_kratos_session cookie" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Static assets preprocessor only supports GET and HEAD requests" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|respondError"                 # respondError is a function name, output via http middleware as standard request logging
-    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|GET /kibana/"                 # Ignore Kibana queries with triggered words
 fi

 if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
@@ -1,7 +1,7 @@
 elasticsearch:
  enabled: false
  esheap: '600m'
-  version: 9.4.8
+  version: 9.4.5
  index_clean: true
  data_retention_method: DLM
  vm:
@@ -22,7 +22,7 @@ kibana:
          - default
          - file
    migrations:
-      discardCorruptObjects: "9.4.8"
+      discardCorruptObjects: "9.4.5"
    telemetry:
      enabled: False
    xpack:
@@ -1131,6 +1131,9 @@ post_to_3.2.0() {

 ### 3.3.0 Scripts ###
 up_to_3.3.0() {
+  # download 9.4.5 elastic agent packages
+  determine_elastic_agent_upgrade
+  
  # remove existing (patched) elasticsearch index template to match integration naming change
  if ! remove_elasticsearch_index_template "so-logs-sentinel_one_cloud_funnel.login" "sentinel_one_cloud_funnel.login changed to sentinel_one_cloud_funnel.logins"; then
    FINAL_MESSAGE_QUEUE+=("WARNING: Unable to automatically remove the so-logs-sentinel_one_cloud_funnel.login index template. This step can be performed manually using the following command:")
@@ -1162,7 +1165,11 @@ telegraf_repair() {
 post_to_3.3.0() {
  # Recollate again since some internal DBs were excluded during 3.2.0 soup
  recollate_postgres
-  
+
+  # Generate 9.4.5 elastic agent installers
+  echo "Regenerating Elastic Agent Installers"
+  /sbin/so-elastic-agent-gen-installers
+
  telegraf_repair

  set_postversion 3.3.0
@@ -1171,9 +1178,6 @@ post_to_3.3.0() {

 ### 3.4.0 Scripts ###
 up_to_3.4.0() {
-  # download 9.4.8 elastic agent packages
-  determine_elastic_agent_upgrade
-  
  set_soauth_range

  echo "Removing so-kratos, so-hydra and so-soc so they are recreated on the soauth network."
@@ -1251,10 +1255,6 @@ valid_soauth_range() {
 }

 post_to_3.4.0() {
-  # Generate 9.4.8 elastic agent installers
-  echo "Regenerating Elastic Agent Installers"
-  /sbin/so-elastic-agent-gen-installers
-  
  for idx in "metrics-logstash.node-default" "metrics-logstash.stack_monitoring.node-default"; do
    rollover_index "$idx"
  done
@@ -1535,10 +1535,9 @@ verify_es_version_compatibility() {
      ["8.18.4"]="8.18.6 8.18.8 9.0.8"
 	    ["8.18.6"]="8.18.8 9.0.8"
 	    ["8.18.8"]="9.0.8"
-      ["9.0.8"]="9.3.3 9.3.7 9.4.5 9.4.8"
-      ["9.3.3"]="9.3.7 9.4.5 9.4.8"
-      ["9.3.7"]="9.4.5 9.4.8"
-      ["9.4.5"]="9.4.8"
+      ["9.0.8"]="9.3.3 9.3.7 9.4.5"
+      ["9.3.3"]="9.3.7 9.4.5"
+      ["9.3.7"]="9.4.5"
    )

    # Elasticsearch MUST upgrade through these versions
@@ -1540,10 +1540,8 @@ soc:
          agentic: false
          agentMapping:
            Orchestrator: sonnet@SOAI
-            Investigator: haiku@SOAI
-            DetectionEngineer: haiku@SOAI
-            AlertTriage: haiku@SOAI
-            Notifier: haiku@SOAI
+            Investigator: gemma@SOAI
+            DetectionEngineer: gemma@SOAI
          useMemory: false
          useMemoryScanner: false
          dontScanBefore: ""
@@ -1823,7 +1821,6 @@ soc:
        cacheExpirationMs: 300000
        casesEnabled: true
        detectionsEnabled: true
-        allowExternalMarkdownImages: false
        inactiveTools: ['toolUnused']
        exportNodeId:
        tools:
@@ -2816,15 +2813,6 @@ soc:
              enabled: true
              adapter: SOAI
              charsPerTokenEstimate: 4
-            - id: haiku
-              displayName: Claude Haiku
-              origin: USA
-              contextLimitSmall: 1000000
-              contextLimitLarge: 1000000
-              lowBalanceColorAlert: 500000
-              enabled: true
-              adapter: SOAI
-              charsPerTokenEstimate: 4
            - id: gemma
              displayName: Gemma
              origin: USA
@@ -513,10 +513,6 @@ soc:
            description: Enables or disables the SOC notification module.
            forcedType: bool
            global: True
-          connectionTimeoutSeconds:
-            description: Duration (in seconds) to wait for a response from the remote notification endpoint host before giving up.
-            forcedType: int
-            global: True
        postgres:
          host:
            description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.
@@ -941,12 +937,6 @@ soc:
            DetectionEngineer:
              description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
              global: True
-            AlertTriage:
-              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
-              global: True
-            Notifier:
-              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
-              global: True
          useMemory:
            description: Enables the Memory system for OnionAI
            global: True
@@ -1035,7 +1025,7 @@ soc:
            forcedType: int
          automationSettings:
            tickIntervalSeconds:
-              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0. This value is also the default interval for new automations, however admins can override individual automation intervals to a longer value via the Agent Studio.
+              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0.
              global: True
              advanced: True
              forcedType: int
@@ -1161,10 +1151,6 @@ soc:
          description: Set to true to enable the Detections module in SOC.
          global: True
          forcedType: bool
-        allowExternalMarkdownImages:
-          description: Set to true to let user-written Markdown, such as case descriptions and comments, load images from other servers. Loading an image sends a request to its server, so leave this disabled unless needed; Onion AI output never loads external images.
-          global: True
-          forcedType: bool
        inactiveTools:
          description: List of external tools to remove from the SOC UI.
          global: True
@@ -1333,8 +1333,8 @@ DISA STIG for Oracle Linux 9 V1R3.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="false"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>
@@ -1935,8 +1935,8 @@ standard DISA STIG for Oracle Linux 9 profile.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="false"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>