Refactor correlation template

Automation Turn Timeout

salt/soc/defaults.yaml

@@ -1545,7 +1545,6 @@ soc:
             Investigator: haiku@SOAI
             DetectionEngineer: haiku@SOAI
             AlertTriage: haiku@SOAI
-            Notifier: haiku@SOAI
           useMemory: false
           useMemoryScanner: false
           dontScanBefore: ""
@@ -1572,6 +1571,7 @@ soc:
             tickIntervalSeconds: 60
             maxConcurrentItems: 4
             maxQueuedItems: 0
+            turnTimeoutSeconds: 300
             alertTriageEpoch: "2026-09-24T00:00:00Z"
           tools:
             filterEventFields:
@@ -2527,6 +2527,9 @@ soc:
           queries:
             - name: 'Group By Name, Module'
               query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
+            - name: 'Group By Assessment, Name'
+              query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid'
+              license: oai
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
               query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
             - name: 'Group By Source IP, Name'
@@ -2806,6 +2809,10 @@ soc:
               # Sigma correlation rule; requires ES|QL (useEsql).
               # First document: the correlation. Following documents: the rules it references.
               #
+              # This example mirrors the shipped rule c448c9f6 (Repeated SOC Login Failures For One Account).
+              # Change it before enabling, or you will get two alerts for the same activity.
+              # To test: log out of SOC and enter a wrong password 5 times for one username.
+              #
               # Types: event_count, value_count, temporal, value_sum, value_avg, value_median, value_percentile.
               # Correlation Guide: https://sigmahq.io/docs/meta/correlations.html
               # Logsources: https://sigmahq.io/docs/basics/log-sources.html
@@ -2814,46 +2821,45 @@ soc:
               id: [publicId]
               status: 'experimental'
               description: |
-                  Describe what the correlation finds and, importantly, why relating these
-                  events is more meaningful than either of them alone.
+                  Describe what the correlation finds and why relating these events is more
+                  meaningful than any one of them alone.
+                  Example: 5 or more failed SOC logins for one username in 10 minutes.
               references:
-                - 'https://local.invalid'
+                - 'https://attack.mitre.org/techniques/T1110/001/'
               author: '@SecurityOnion'
               date: '[today]'
               tags:
-                - detection.threat_hunting
-                - attack.technique_id
+                - attack.credential-access
+                - attack.t1110.001
               correlation:
-                  type: value_count
+                  type: event_count       # count the base rule's events...
                   rules:
-                      - example_base_rule  # the 'name' of the rule below
+                      - example_base_rule # ...by the 'name' of the rule below
                   group-by:
-                      - source.ip
-                  # Xs, Xm, Xh, Xd or Xw.
-                  timespan: 10m
+                      - user.name         # ...separately for each username
+                  timespan: 10m           # Xs, Xm, Xh
                   condition:
-                      field: dns.query.name
-                      gte: 40
+                      gte: 5
               falsepositives:
-                - 'Describe the benign activity that also produces this pattern'
+                - 'A user entering an old password after a password change'
               # Placeholders: %count%, %start%, %end%, %duration%, or any field.
-              summary: '%count% distinct names queried by %source.ip% in %duration%'
+              summary: '%count% failed SOC logins for %user.name% in %duration%, from %http.request.headers.x-real-ip%'
               level: 'medium'  # info | low | medium | high | critical
               ---
-              title: 'Base Event'
+              title: 'SOC Login Failure'
               # referenced by 'name' (or 'id')
               name: example_base_rule
-              description: 'The single event that the correlation aggregates.'
+              description: 'One failed SOC login. Put filters here, not in the correlation.'
               logsource:
-                category: network
-                service: dns
+                product: kratos
+                service: application
               detection:
                   selection:
-                      dns.query.name|exists: true
+                      msg: 'Encountered self-service login error.'
                   condition: selection
               # Carried into the alert.
               fields:
-                - dns.query.name
+                - http.request.headers.x-real-ip
         assistant:
           enabled: false
           investigationPrompt: Investigate Alert ID {socId}

salt/soc/merged.map.jinja

@@ -22,6 +22,43 @@
 {% do SOCMERGED.config.server.update({'additionalCA': MANAGERMERGED.additionalCA}) %}
 {% do SOCMERGED.config.server.update({'insecureSkipVerify': MANAGERMERGED.insecureSkipVerify}) %}
 
+{# pillar.get replaces lists instead of merging them, so combine availableModels by id and alerts queries by name #}
+{% set default_models = {} %}
+{% for m in SOCDEFAULTS.config.server.client.assistant.availableModels %}
+{%   do default_models.setdefault(m.id, m) %}
+{% endfor %}
+{% set merged_models = [] %}
+{% set merged_ids = [] %}
+{% for m in SOCMERGED.config.server.client.assistant.availableModels or [] %}
+{%   set model = {} %}
+{%   do model.update(default_models.get(m.get('id'), {})) %}
+{%   do model.update(m) %}
+{%   do merged_models.append(model) %}
+{%   do merged_ids.append(m.get('id')) %}
+{% endfor %}
+{% for id, m in default_models.items() if id not in merged_ids %}
+{%   do merged_models.append(m) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.assistant.update({'availableModels': merged_models}) %}
+
+{% set default_queries = {} %}
+{% for q in SOCDEFAULTS.config.server.client.alerts.queries %}
+{%   do default_queries.setdefault(q.name, q) %}
+{% endfor %}
+{% set merged_queries = [] %}
+{% set merged_names = [] %}
+{% for q in SOCMERGED.config.server.client.alerts.queries or [] %}
+{%   set query = {} %}
+{%   do query.update(default_queries.get(q.get('name'), {})) %}
+{%   do query.update(q) %}
+{%   do merged_queries.append(query) %}
+{%   do merged_names.append(q.get('name')) %}
+{% endfor %}
+{% for name, q in default_queries.items() if name not in merged_names %}
+{%   do merged_queries.append(q) %}
+{% endfor %}
+{% do SOCMERGED.config.server.client.alerts.update({'queries': merged_queries}) %}
+
 {% if not SOCMERGED.config.server.modules.postgres.host %}
 {%   do SOCMERGED.config.server.modules.postgres.update({'host': GLOBALS.manager}) %}
 {% endif %}

salt/soc/soc_soc.yaml

@@ -954,10 +954,7 @@ soc:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
             AlertTriage:
-              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can notify through the Notifier but cannot acknowledge alerts or escalate to cases.
-              global: True
-            Notifier:
-              description: This agent sends a single notification on behalf of another agent, such as AlertTriage, and takes no other action.
+              description: This agent triages alerts autonomously for the Alert Triage automation, ending each run with a report and an assessment of the alert. It can send a notification but cannot acknowledge alerts or escalate to cases.
               global: True
           useMemory:
             description: Enables the Memory system for OnionAI
@@ -1061,11 +1058,18 @@ soc:
               global: True
               advanced: True
               forcedType: int
+            turnTimeoutSeconds:
+              description: Maximum number of seconds a single model turn of an automation's agent session may run, even while the model is still producing output. A turn that exceeds this limit is abandoned and the session is recorded as failed. Set to 0 to disable the timeout. Edit this setting via the Agent Studio.
+              global: True
+              advanced: True
+              forcedType: int
+              readonlyUi: True
             alertTriageEpoch:
               description: The earliest alert time the Alert Triage automation will consider. Alerts before this time are never triaged, which keeps a first run on an existing deployment from working through old history. Must be in UTC format (2026-09-24T00:00:00Z).
               regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'
               regexFailureMessage: Expecting date in RFC3339 format (2026-09-24T00:00:00Z)
               global: True
+              readonlyUi: True
               advanced: True
           tools:
             filterEventFields:
@@ -1229,6 +1233,8 @@ soc:
             - field: showSubtitle
               label: Show Query in Dropdown.
               forcedType: bool
+            - field: license
+              label: Only show on grids licensed for this feature, e.g. oai. An oai query also needs the assistant enabled and agentic. Leave blank to show everywhere.
           queryToggleFilters:
             description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.
             global: True