Merge pull request #16312 from Security-Onion-Solutions/mwright/md-img-toggle

Add allowExternalMarkdownImages SOC Setting

salt/common/tools/sbin/so-log-check

@@ -178,6 +178,7 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Missing ory_kratos_session cookie" # expected WARN log lines indicating invalid auth header
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Static assets preprocessor only supports GET and HEAD requests" # expected WARN log lines indicating invalid auth header
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|respondError"                 # respondError is a function name, output via http middleware as standard request logging
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|GET /kibana/"                 # Ignore Kibana queries with triggered words
 fi
 
 if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then

salt/soc/defaults.yaml

@@ -1821,6 +1821,7 @@ soc:
         cacheExpirationMs: 300000
         casesEnabled: true
         detectionsEnabled: true
+        allowExternalMarkdownImages: false
         inactiveTools: ['toolUnused']
         exportNodeId:
         tools:

salt/soc/soc_soc.yaml

@@ -513,6 +513,10 @@ soc:
             description: Enables or disables the SOC notification module.
             forcedType: bool
             global: True
+          connectionTimeoutSeconds:
+            description: Duration (in seconds) to wait for a response from the remote notification endpoint host before giving up.
+            forcedType: int
+            global: True
         postgres:
           host:
             description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.
@@ -1025,7 +1029,7 @@ soc:
             forcedType: int
           automationSettings:
             tickIntervalSeconds:
-              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0.
+              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0. This value is also the default interval for new automations, however admins can override individual automation intervals to a longer value via the Agent Studio.
               global: True
               advanced: True
               forcedType: int
@@ -1151,6 +1155,10 @@ soc:
           description: Set to true to enable the Detections module in SOC.
           global: True
           forcedType: bool
+        allowExternalMarkdownImages:
+          description: Set to true to let user-written Markdown, such as case descriptions and comments, load images from other servers. Loading an image sends a request to its server, so leave this disabled unless needed; Onion AI output never loads external images.
+          global: True
+          forcedType: bool
         inactiveTools:
           description: List of external tools to remove from the SOC UI.
           global: True