Merge branch '3/dev' into jertel/wip

Surface ILM policy validation errors in highstate
Fail 4xx ILM PUTs immediately (retry 429/5xx/connect), print the Elasticsearch reason in the salt summary, and retry the load on the next highstate via /opt/so/state/esilm.txt when the last run failed. Fixes https://github.com/Security-Onion-Solutions/sos/issues/277
2026-11-12 23:50:31 +01:00 · 2026-11-11 15:42:51 -05:00 · 2026-11-11 15:40:50 -05:00 · 2026-11-11 15:40:50 -05:00 · 2026-11-11 15:40:50 -05:00 · 2026-11-11 15:40:50 -05:00
2 changed files with 2 additions and 9 deletions
@@ -16,12 +16,6 @@ include:
  - nginx.config
  - nginx.sostatus

-fleet_beats_dir_nginx:
-  file.directory:
-    - name: /nsm/elastic-fleet/artifacts/beats
-    - makedirs: True
-    - show_changes: False
-
 {%   if GLOBALS.role != 'so-fleet' %}
 {%     set container_config = 'so-nginx' %}
 make-rule-dir-nginx:
@@ -60,7 +54,7 @@ so-nginx:
      - /opt/so/log/nginx/:/var/log/nginx:rw
      - /opt/so/tmp/nginx/:/var/lib/nginx:rw
      - /opt/so/tmp/nginx/:/run:rw
-      - /nsm/elastic-fleet/artifacts/beats/:/opt/socore/elastic-artifacts/artifacts/beats:ro
+      - /nsm/elastic-fleet/artifacts/:/opt/socore/elastic-artifacts/artifacts:ro
      {% if GLOBALS.is_manager %}
      - /nsm/elastic-fleet/so_agent-installers/:/opt/socore/html/packages
      - /etc/pki/managerssl.crt:/etc/pki/nginx/server.crt:ro
@@ -112,7 +106,6 @@ so-nginx:
      {% endif %}
    - require:
      - file: nginxconf
-      - file: fleet_beats_dir_nginx
      {% if GLOBALS.is_manager %}
      {%   if NGINXMERGED.ssl.replace_cert %}
      - file: managerssl_key
@@ -57,7 +57,7 @@ http {
    server_name {{ GLOBALS.hostname }};
    {%- endif %}
 		root /opt/socore/elastic-artifacts;
-		location /artifacts/beats/ {
+		location /artifacts/ {
 			try_files $uri =404;
 		}
 		location / {
Author	SHA1	Message	Date
Jason Ertel	9a0e88f8d2	Merge branch '3/dev' into jertel/wip	2026-11-11 15:42:51 -05:00
reyesj2	d37241376a	Surface ILM policy validation errors in highstate Fail 4xx ILM PUTs immediately (retry 429/5xx/connect), print the Elasticsearch reason in the salt summary, and retry the load on the next highstate via /opt/so/state/esilm.txt when the last run failed. Fixes https://github.com/Security-Onion-Solutions/sos/issues/277	2026-11-11 15:40:50 -05:00
reyesj2	3d8e6d0c6e	Wait for Elasticsearch and retry ILM policy loads Require wait_for_so-elasticsearch, check ES is responsive before dispatch, and retry each policy PUT so soup no longer fails with empty output when ES is not ready yet. Fixes https://github.com/Security-Onion-Solutions/securityonion/issues/16369	2026-11-11 15:40:50 -05:00
reyesj2	ddf168f062	Skip leftover ISO registry.tar when tags do not match SOVERSION Fixes #16372	2026-11-11 15:40:50 -05:00
Doug Burks	693f7917ae	Install securityonion-so-crates on Security Onion Desktop	2026-11-11 15:40:50 -05:00
Mike Reeves	3682e0fde6	Remove x86-64-v3 CPU check from soup	2026-11-11 15:40:50 -05:00
Mike Reeves	161d0d145f	Add version 3.5.0 to discussion template	2026-11-11 15:40:50 -05:00
Mike Reeves	c04f06af1e	Bump version from 3.4.0 to 3.5.0	2026-11-11 15:40:49 -05:00
Mike Reeves	7b2c44e965	3.4.0	2026-11-11 15:40:49 -05:00
Mike Reeves	9895dfbe7f	3.4.0	2026-11-11 15:40:49 -05:00
Corey Ogburn	a21d4b5f1b	New Configurable Timeouts for Detection Engine Syncs Each engine now has timeouts for how long to allow a sync to go on after detections are modified.	2026-11-11 15:40:49 -05:00
Mike Reeves	f5edb1f6a4	Use the host CA trust store for sensor, strelka and idh containers Mount the host trust store into zeek, suricata, tcpreplay, the strelka containers and idh, and restart them when it changes. Point the Python requests clients in strelka-backend and idh at it instead of certifi. Remove the frozen /opt/so/conf/ca bundles from every node in ca.trust rather than only on the manager in soup.	2026-11-11 15:40:49 -05:00
Mike Reeves	708b872583	Use the host CA trust store for all grid containers Anchor the grid CA and blocklist the eMudhra roots in the host trust store (new ca.trust state, also used by the desktop role), then mount the extracted store into each container instead of the frozen copies made by so-catrust. Containers restart when the host trust changes.	2026-11-11 15:40:49 -05:00
Mike Reeves	844ca33aed	Remove unused elasticsearch.p12/sokeys keystore	2026-11-11 15:40:49 -05:00
Josh Patterson	45046b946e	Add custom_bind_mounts to so-kafka and so-soc Every container in docker/defaults.yaml exposes custom_bind_mounts via soc_docker.yaml, but kafka and soc enabled.sls never appended them to binds, so the setting was silently ignored for those two containers.	2026-11-11 15:40:49 -05:00