Map the AlertTriage and Notifier agents to a model

SOC disables a built-in agent that has no agentMapping entry, so the new
AlertTriage agent and the Notifier it delegates to need one to run.

salt/soc/defaults.yaml

@@ -1542,6 +1542,8 @@ soc:
             Orchestrator: sonnet@SOAI
             Investigator: gemma@SOAI
             DetectionEngineer: gemma@SOAI
+            AlertTriage: gemma@SOAI
+            Notifier: gemma@SOAI
           useMemory: false
           useMemoryScanner: false
           dontScanBefore: ""

salt/soc/soc_soc.yaml

@@ -937,6 +937,12 @@ soc:
             DetectionEngineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
+            AlertTriage:
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
+              global: True
+            Notifier:
+              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
+              global: True
           useMemory:
             description: Enables the Memory system for OnionAI
             global: True
@@ -1025,7 +1031,7 @@ soc:
             forcedType: int
           automationSettings:
             tickIntervalSeconds:
-              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0.
+              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0. This value is also the default interval for new automations, however admins can override individual automation intervals to a longer value via the Agent Studio.
               global: True
               advanced: True
               forcedType: int