Run zeekctl cron when cron-only zeekctl settings change

LogExpireInterval, StatsLogExpireInterval, CrashExpireInterval, MinDiskSpace
and MailHostUpDown are only acted on by ZeekControl's 'cron' command, which
nothing ever ran, so setting them in SOC had no effect.

Track those five in /opt/so/state/zeek/zeekctl_cron_settings and trigger the
cron run off that file, so unrelated edits like CompressLogs don't fire it.
Runs as the zeek user to avoid root-owned files under /nsm/zeek, with
--no-watch so the crashed-node watchdog doesn't race the container restart.

salt/soc/soc_soc.yaml

@@ -732,13 +732,11 @@ soc:
             global: True
             advanced: True
             forcedType: int
-            readonlyUi: True
           maxDelegationDepth:
             description: Maximum delegation nesting depth for sub-agents. For example, a value of 2 lets the main agent delegate to a sub-agent that may itself delegate one level deeper. Any deeper delegation is refused and the requesting agent continues without it. Set to 0 to disable the limit.
             global: True
             advanced: True
             forcedType: int
-            readonlyUi: True
           adapters:
             description: Configuration for AI adapters used by the Onion AI assistant. Please see documentation for help on which fields are required for which protocols.
             global: True
@@ -781,60 +779,6 @@ soc:
             description: Indicates if the Assistant Module should operate in agentic mode or not. If true, agents can work together to solve tasks.
             global: True
             forcedType: bool
-          agents:
-            description: Agent definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system agent overrides only the fields an admin may change; everything else comes from the built-in definition.
-            global: True
-            advanced: False
-            readonlyUi: True
-            storage: db
-            forcedType: "[]{}"
-            helpLink: onion-ai
-            syntax: json
-            uiElements:
-            - field: name
-              label: Name
-              required: True
-            - field: enabled
-              label: Enabled
-              forcedType: bool
-            - field: isOrchestrator
-              label: Orchestrator
-              forcedType: bool
-            - field: model
-              label: Model
-            - field: allowedSkills
-              label: Skills
-              forcedType: "[]string"
-            - field: canDelegateTo
-              label: Delegates To
-              forcedType: "[]string"
-            - field: description
-              label: Description
-            - field: persona
-              label: Persona
-              multiline: True
-          skills:
-            description: Skill definitions for the Onion AI assistant, managed from the Agent Studio. An entry naming a system skill overrides only its enabled state and persona addendum; its tool set comes from the built-in definition.
-            global: True
-            advanced: False
-            readonlyUi: True
-            storage: db
-            forcedType: "[]{}"
-            helpLink: onion-ai
-            syntax: json
-            uiElements:
-            - field: name
-              label: Name
-              required: True
-            - field: enabled
-              label: Enabled
-              forcedType: bool
-            - field: tools
-              label: Tools
-              forcedType: "[]string"
-            - field: persona
-              label: Persona
-              multiline: True
           agentMapping:
             Orchestrator:
               description: The initial agent in most agentic conversations. This agent will delegate requests to specialized agents.

salt/zeek/config.sls

@@ -133,6 +133,20 @@ zeekctlcfg:
     - defaults:
         ZEEKCTL: {{ ZEEKMERGED.config.zeekctl | tojson }}
 
+# ZeekControl only acts on these five settings from its 'cron' command, so track them
+# separately from zeekctl.cfg. Changing CompressLogs or LogRotationInterval rewrites
+# zeekctl.cfg but must not trigger a cron run, so zeekctlcron watches this file instead.
+zeekctlcronsettings:
+  file.managed:
+    - name: /opt/so/state/zeek/zeekctl_cron_settings
+    - makedirs: True
+    - contents: |
+        LogExpireInterval={{ ZEEKMERGED.config.zeekctl.get('LogExpireInterval', '') }}
+        StatsLogExpireInterval={{ ZEEKMERGED.config.zeekctl.get('StatsLogExpireInterval', '') }}
+        CrashExpireInterval={{ ZEEKMERGED.config.zeekctl.get('CrashExpireInterval', '') }}
+        MinDiskSpace={{ ZEEKMERGED.config.zeekctl.get('MinDiskSpace', '') }}
+        MailHostUpDown={{ ZEEKMERGED.config.zeekctl.get('MailHostUpDown', '') }}
+
 # Sync node.cfg
 nodecfg:
   file.managed:

salt/zeek/enabled.sls

@@ -71,6 +71,25 @@ so-zeek:
       - file: zeekctlcfg
       - file: zeekbpf
 
+# LogExpireInterval, StatsLogExpireInterval, CrashExpireInterval, MinDiskSpace and
+# MailHostUpDown stay inert until 'zeekctl cron' runs, so run it once whenever one of
+# them changes. --no-watch skips ZeekControl's crashed-node watchdog, which would
+# otherwise race the container restart that the same config change triggers, and which
+# would duplicate the healthcheck beacon in salt/_beacons/zeek.py. The retry covers the
+# startup deploy still holding the ZeekControl lock. Run as the zeek user, as
+# salt/_modules/zeekctl.py does, so the stats logs and zeekctl-config.sh this writes stay
+# owned by uid 937 rather than root.
+zeekctlcron:
+  cmd.run:
+    - name: docker exec so-zeek runuser -l zeek -c '/opt/zeek/bin/zeekctl cron --no-watch'
+    - onchanges:
+      - file: zeekctlcronsettings
+    - require:
+      - docker_container: so-zeek
+    - retry:
+        attempts: 5
+        interval: 30
+
 delete_so-zeek_so-status.disabled:
   file.uncomment:
     - name: /opt/so/conf/so-status/so-status.conf

salt/zeek/soc_zeek.yaml

@@ -58,6 +58,26 @@ zeek:
       CompressLogs:
         description: This setting enables compression of Zeek logs. If you are seeing packet loss at the top of the hour in Zeek or PCAP you might need to disable this by seting it to 0. This will use more disk space but save IO and CPU.
         helpLink: zeek
+      LogExpireInterval:
+        description: Number of days to keep rotated Zeek logs in /nsm/zeek/logs, or 0 to keep them forever. Saving this setting runs "zeekctl cron", which deletes any logs already older than the value you set. Note that this is a one time cleanup rather than a rolling retention policy, so logs that age past the interval afterwards are not removed until this setting is changed again. Ongoing cleanup based on disk usage is handled separately by so-sensor-clean.
+        helpLink: zeek
+        advanced: True
+      StatsLogExpireInterval:
+        description: Number of days to keep entries in the Zeek stats log, or 0 to keep them forever. Saving this setting runs "zeekctl cron", which applies the new value once. See LogExpireInterval for details on this behavior.
+        helpLink: zeek
+        advanced: True
+      CrashExpireInterval:
+        description: Number of days to keep Zeek crash directories, or 0 to keep them forever. Saving this setting runs "zeekctl cron", which applies the new value once. See LogExpireInterval for details on this behavior.
+        helpLink: zeek
+        advanced: True
+      MinDiskSpace:
+        description: Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check. This check only runs during "zeekctl cron", which Security Onion runs when you save this setting. It does not delete anything.
+        helpLink: zeek
+        advanced: True
+      MailHostUpDown:
+        description: Set to 1 to send mail when a Zeek node changes between the up and down states. This check only runs during "zeekctl cron", which Security Onion runs when you save this setting, so it is not a continuous monitor. Requires MailTo to be set to a working address.
+        helpLink: zeek
+        advanced: True
   policy:
     custom:
       filters: