Name the reposync-side kernel repo securityonionkernelsync

The reposync section in repodownload.conf and the client repo assigned in
repo/client/oracle.sls both used the bare name securityonionkernel, colliding
across the two roles. Rename the reposync-side section (and its --repoid, the
so-repo-sync guard, and the so-kernel-upgrade presence check) to
securityonionkernelsync, mirroring the existing securityonion/securityonionsync
split for the main repo. The client repo stays securityonionkernel. Also give
the section its own name=Security Onion Kernel Repo repo.

pillar/data/addtotab.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# This script adds sensors/nodes/etc to the nodes tab
+default_salt_dir=/opt/so/saltstack/default
+local_salt_dir=/opt/so/saltstack/local
+TYPE=$1
+NAME=$2
+IPADDRESS=$3
+CPUS=$4
+GUID=$5
+MANINT=$6
+ROOTFS=$7
+NSM=$8
+MONINT=$9
+#NODETYPE=$10
+#HOTNAME=$11
+
+echo "Seeing if this host is already in here. If so delete it"
+if grep -q $NAME "$local_salt_dir/pillar/data/$TYPE.sls"; then
+  echo "Node Already Present - Let's re-add it"
+  awk -v blah="  $NAME:" 'BEGIN{ print_flag=1 }
+{
+    if( $0 ~ blah )
+    {
+       print_flag=0;
+       next
+    }
+    if( $0 ~ /^  [a-zA-Z0-9]+:$/ )
+    {
+        print_flag=1;
+    }
+    if ( print_flag == 1 )
+        print $0
+
+} ' $local_salt_dir/pillar/data/$TYPE.sls > $local_salt_dir/pillar/data/tmp.$TYPE.sls
+mv $local_salt_dir/pillar/data/tmp.$TYPE.sls $local_salt_dir/pillar/data/$TYPE.sls
+echo "Deleted $NAME from the tab. Now adding it in again with updated info"
+fi
+echo "  $NAME:" >> $local_salt_dir/pillar/data/$TYPE.sls
+echo "    ip: $IPADDRESS" >> $local_salt_dir/pillar/data/$TYPE.sls
+echo "    manint: $MANINT" >> $local_salt_dir/pillar/data/$TYPE.sls
+echo "    totalcpus: $CPUS" >> $local_salt_dir/pillar/data/$TYPE.sls
+echo "    guid: $GUID" >> $local_salt_dir/pillar/data/$TYPE.sls
+echo "    rootfs: $ROOTFS" >> $local_salt_dir/pillar/data/$TYPE.sls
+echo "    nsmfs: $NSM" >> $local_salt_dir/pillar/data/$TYPE.sls
+if [ $TYPE == 'sensorstab' ]; then
+  echo "    monint: bond0" >> $local_salt_dir/pillar/data/$TYPE.sls
+fi
+if [ $TYPE == 'evaltab' ] || [ $TYPE == 'standalonetab' ]; then
+  echo "    monint: bond0" >> $local_salt_dir/pillar/data/$TYPE.sls
+  if [ ! $10 ]; then
+    salt-call state.apply utility queue=True
+  fi
+fi
+if [ $TYPE == 'nodestab' ]; then
+  salt-call state.apply elasticsearch queue=True
+#  echo "    nodetype: $NODETYPE" >> $local_salt_dir/pillar/data/$TYPE.sls
+#  echo "    hotname: $HOTNAME" >> $local_salt_dir/pillar/data/$TYPE.sls
+fi

salt/allowed_states.map.jinja

@@ -37,7 +37,8 @@
     'elasticfleet',
     'elasticfleet.manager',
     'elasticsearch.cluster',
-    'elastic-fleet-package-registry'
+    'elastic-fleet-package-registry',
+    'utility'
 ] %}
 
 {% set sensor_states = [

salt/common/tools/sbin/so-common

@@ -291,20 +291,6 @@ download_and_verify() {
 	fi
 }
 
-# check if container with name is running and optionally stop it
-docker_check_running() {
-    # show running containers, only names
-    if docker ps --format '{{.Names}}' | grep -q "^so-${1}$"; then
-        if [[ "$2" == "--stop" ]]; then
-            docker stop "so-${1}"
-        fi
-
-        return 0
-    else
-        return 1
-    fi
-}
-
 elastic_license() {
 
 read -r -d '' message <<- EOM

salt/common/tools/sbin/so-kernel-upgrade

@@ -5,53 +5,239 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 #
-# so-kernel-upgrade — switch the boot default to the installed UEK8 (6.x) kernel.
+# so-kernel-upgrade — install the UEK8 (6.x) kernel and make it the boot default.
 #
-# Security Onion is moving off the EL9 stock kernel / UEK7 (5.x) onto UEK8 (6.x).
+# Security Onion is moving off the EL9 stock kernel (RHCK, 5.14) and UEK7 (5.15) onto UEK8
-# Installing the kernel-uek-core package adds a UEK8 boot entry but does NOT make it the
+# (6.x). Three things have to happen, and the tool has to drive each one:
-# default: kernel-install/grubby only auto-promote a new kernel within the running
-# kernel's flavor lineage, and we're crossing from a 5.x kernel to the new 6.x UEK flavor.
-# So even with UPDATEDEFAULT=yes and DEFAULTKERNEL=kernel-uek-core the box keeps booting
-# the old kernel. This tool finds the newest installed 6.x UEK kernel and makes it the
-# GRUB default via grubby so the next boot comes up on UEK8.
 #
-# Idempotent: if the UEK8 kernel is already the default it does nothing. It only sets the
+#   1. Populate. The manager mirrors the UEK8 packages into /nsm/kernelrepo via so-repo-sync,
-# boot default; it does NOT reboot — the admin reboots the node on their own schedule.
+#      and serves them to the grid over https://<manager>/kernelrepo. Until that sync runs the
+#      repo is valid but EMPTY -- dnf resolves it happily and installs nothing, with no error.
+#   2. Install. A node on RHCK has no kernel-uek* package at all, so there is nothing for
+#      'dnf update' to upgrade. A node on UEK7 does have kernel-uek installed, so
+#      'dnf install kernel-uek' reports "Nothing to do" and exits 0 without installing 6.x.
+#      Both cases need an explicit install of the UEK8 NEVRA.
+#   3. Boot it. Whether a newly installed UEK8 kernel becomes the boot default depends on the
+#      RUNNING kernel's flavor. kernel-install/grubby (with UPDATEDEFAULT=yes) only auto-promote
+#      within the running kernel's flavor lineage:
+#        - From UEK7 (5.x, kernel-uek) the install stays in the kernel-uek lineage and IS
+#          auto-promoted, so no grubby change is needed -- just make sure the repo is populated
+#          and install UEK8.
+#        - From the stock EL9 kernel (RHCK, 5.14, no UEK) it is a flavor CROSS that is NOT
+#          auto-promoted, so the box keeps booting RHCK until grubby is told otherwise.
+#      This tool inspects the running kernel and only runs 'grubby --set-default' for RHCK.
+#
+# Every one of those failure modes is silent by default. This tool handles each case and fails
+# loudly when it cannot, rather than reporting success while changing nothing.
+#
+# Manager vs minion: only the manager owns /nsm/kernelrepo, so only the manager can populate
+# it. If the repo is empty here, a manager runs so-repo-sync itself; a minion has no way to
+# fix it and exits non-zero telling the admin to sync the manager first.
+#
+# Idempotent: an already-installed, already-default UEK8 kernel is left alone. It only sets
+# the boot default; it does NOT reboot -- the admin reboots the node on their own schedule.
+
+. /usr/sbin/so-common
+
+# Client-side repo id (what dnf enables on this node, from repo/client/oracle.sls) vs the
+# reposync-side section in repodownload.conf that the manager mirrors from (mirrors the
+# securityonion/securityonionsync split for the main repo).
+KERNEL_REPO="securityonionkernel"
+KERNEL_REPO_SYNC="securityonionkernelsync"
+KERNEL_PKG="kernel-uek"
+KERNEL_REPO_DIR="/nsm/kernelrepo"
+REPOSYNC_CONF="/opt/so/conf/reposync/repodownload.conf"
+GLOBAL_PILLAR="/opt/so/saltstack/local/pillar/global/soc_global.sls"
 
 log() { echo "[so-kernel-upgrade] $*"; }
+die() { echo "[so-kernel-upgrade] ERROR: $*" >&2; exit 1; }
 
-[ "$(id -u)" -eq 0 ] || { log "must run as root"; exit 1; }
+command -v grubby >/dev/null 2>&1 || die "grubby not found"
-command -v grubby >/dev/null 2>&1 || { log "grubby not found"; exit 1; }
+command -v dnf >/dev/null 2>&1 || die "dnf not found"
+
+ARCH="$(rpm -E '%{_arch}')"
+
+is_airgap() {
+    [ -f "$GLOBAL_PILLAR" ] && grep -q 'airgap: *[Tt]rue' "$GLOBAL_PILLAR"
+}
 
 # Newest installed UEK8 (6.x) kernel known to the bootloader. UEK8 vmlinuz paths look like
-# /boot/vmlinuz-6.12.0-203.76.7.5.el9uek.x86_64; the 5.x UEK7 and 5.14 RHCK won't match.
+# /boot/vmlinuz-6.12.0-204.92.4.2.el9uek.x86_64; UEK7 (5.15) and RHCK (5.14) won't match.
-target="$(grubby --info=ALL 2>/dev/null \
+find_uek8() {
-    | sed -n 's/^kernel="\(.*\)"$/\1/p' \
+    grubby --info=ALL 2>/dev/null \
-    | grep -E '/vmlinuz-6\.[0-9]+.*uek' \
+        | sed -n 's/^kernel="\(.*\)"$/\1/p' \
-    | sort -V | tail -1)"
+        | grep -E '/vmlinuz-6\.[0-9]+.*uek' \
+        | sort -V | tail -1
+}
 
-if [ -z "$target" ]; then
+# Classify the RUNNING kernel (uname -r) -- this, not what's installed, is what decides whether
-    log "no installed 6.x UEK (UEK8) kernel found — confirm the kernel repo is assigned and"
+# a UEK8 install auto-promotes to the boot default:
-    log "'dnf update' has installed kernel-uek-core. Nothing to do."
+#   uek8  6.x UEK    already on the target line; nothing to do
+#   uek7  5.x UEK    a UEK8 install stays in the kernel-uek lineage and auto-promotes (no grubby)
+#   rhck  5.14 EL9   crossing into the UEK flavor does NOT auto-promote (needs grubby --set-default)
+running_flavor() {
+    case "$(uname -r)" in
+        6.*uek*) echo uek8 ;;
+        *uek*)   echo uek7 ;;
+        *)       echo rhck ;;
+    esac
+}
+
+# Newest UEK8 kernel-uek NEVRA offered by the kernel repo, empty if the repo has none.
+# Restricted to the kernel repo so a UEK7 kernel-uek in the main repo can't be picked up,
+# and filtered to 6.x so we never "succeed" by reinstalling the 5.15 we already have.
+uek8_available() {
+    dnf -q repoquery --disablerepo='*' --enablerepo="$KERNEL_REPO" \
+        --arch="$ARCH" --latest-limit=1 \
+        --qf '%{name}-%{evr}.%{arch}\n' "$KERNEL_PKG" 2>/dev/null \
+        | grep -E "^${KERNEL_PKG}-6\." | tail -1
+}
+
+kernelrepo_rpm_count() {
+    find "$KERNEL_REPO_DIR" -maxdepth 1 -name '*.rpm' 2>/dev/null | wc -l
+}
+
+# The kernel repo starts life as valid-but-empty (kernelrepo_init_empty in
+# salt/manager/init.sls) and is filled by so-repo-sync. During a soup, so-repo-sync runs
+# BEFORE the highstate deploys the [securityonionkernelsync] section into repodownload.conf, so
+# the first kernel-aware soup leaves the repo empty until the next nightly sync.
+sync_kernel_repo() {
+    if is_airgap; then
+        log "airgap install: $KERNEL_REPO_DIR is populated from the airgap ISO, not by so-repo-sync."
+        return 1
+    fi
+    if ! grep -q "^\[${KERNEL_REPO_SYNC}\]" "$REPOSYNC_CONF" 2>/dev/null; then
+        log "$REPOSYNC_CONF has no [${KERNEL_REPO_SYNC}] section -- run a highstate to deploy it."
+        return 1
+    fi
+
+    log "populating $KERNEL_REPO_DIR with so-repo-sync (mirrors upstream; can take several minutes)"
+    su socore -c '/usr/sbin/so-repo-sync' || { log "so-repo-sync failed"; return 1; }
+
+    dnf -q clean expire-cache >/dev/null 2>&1
+    return 0
+}
+
+# Make the kernel repo actually able to serve a UEK8 package, or fail trying.
+ensure_kernel_repo() {
+    # The repo is assigned by the repo.client highstate, and only once NICs are pinned by MAC
+    # (/opt/so/state/nic_names_pinned) so the kernel swap can't renumber interfaces SO binds
+    # by name. skip_if_unavailable=1 means a broken repo is silently ignored, so check first.
+    if ! dnf -q repolist --enabled 2>/dev/null | awk '{print $1}' | grep -qx "$KERNEL_REPO"; then
+        log "repo '$KERNEL_REPO' is not enabled on this node."
+        log "Run a highstate first; the repo is skipped until /opt/so/state/nic_names_pinned"
+        log "exists (run so-nic-pin) and this node's salt matches the version this release ships."
+        die "kernel repo unavailable"
+    fi
+
+    [ -n "$(uek8_available)" ] && return 0
+
+    log "repo '$KERNEL_REPO' is enabled but offers no UEK8 $KERNEL_PKG package"
+
+    if ! is_manager_node; then
+        log "This is a minion; it consumes the kernel repo from the manager and cannot populate it."
+        log "On the manager, run:  su socore -c /usr/sbin/so-repo-sync"
+        log "then re-run this script here."
+        die "manager's kernel repo is empty"
+    fi
+
+    log "this is a manager and $KERNEL_REPO_DIR holds $(kernelrepo_rpm_count) rpm(s)"
+    sync_kernel_repo || die "could not populate $KERNEL_REPO_DIR"
+
+    [ -n "$(uek8_available)" ] \
+        || die "so-repo-sync completed but $KERNEL_REPO still offers no UEK8 $KERNEL_PKG"
+}
+
+reboot_notice() {
+    [ "$(uname -r)" = "$(basename "$1" | sed 's/^vmlinuz-//')" ] \
+        || log "REBOOT REQUIRED to start using the UEK8 kernel (currently running $(uname -r))."
+}
+
+# Keep future kernel updates on the UEK line rather than falling back to RHCK. Oracle ships
+# /etc/sysconfig/kernel; only rewrite it when it's actually pointing somewhere else.
+set_default_kernel_conf() {
+    if [ -f /etc/sysconfig/kernel ] && ! grep -q '^DEFAULTKERNEL=kernel-uek-core$' /etc/sysconfig/kernel; then
+        log "setting DEFAULTKERNEL=kernel-uek-core in /etc/sysconfig/kernel"
+        sed -i 's/^DEFAULTKERNEL=.*/DEFAULTKERNEL=kernel-uek-core/' /etc/sysconfig/kernel
+    fi
+}
+
+# Make sure a UEK8 kernel is installed, leaving its boot entry in INSTALLED_UEK8. If one is
+# already present we leave the repo alone -- it may be disabled or empty and we don't need it
+# just to flip the boot default. Otherwise install the explicit NEVRA, not the bare package
+# name: on a UEK7 node 'dnf install kernel-uek' sees 5.15 already present, prints "Nothing to
+# do" and exits 0 without installing 6.x.
+ensure_uek8_installed() {
+    INSTALLED_UEK8="$(find_uek8)"
+    if [ -n "$INSTALLED_UEK8" ]; then
+        log "UEK8 kernel already installed: $INSTALLED_UEK8"
+        return 0
+    fi
+
+    ensure_kernel_repo
+    local nevra; nevra="$(uek8_available)"
+    log "installing $nevra from $KERNEL_REPO"
+    dnf -y install "$nevra" || die "failed to install $nevra"
+
+    INSTALLED_UEK8="$(find_uek8)"
+    [ -n "$INSTALLED_UEK8" ] || die "$nevra installed but no 6.x UEK boot entry appeared -- check 'grubby --info=ALL'"
+    log "installed UEK8 kernel: $INSTALLED_UEK8"
+}
+
+case "$(running_flavor)" in
+uek8)
+    # Already on the 6.x UEK line. A plain 'dnf update' keeps this node current within the
+    # lineage and auto-promotes newer builds, so there is nothing for this tool to do.
+    log "already running a UEK8 kernel ($(uname -r)); nothing to do."
     exit 0
-fi
+    ;;
 
-current="$(grubby --default-kernel 2>/dev/null)"
+uek7)
-if [ "$current" = "$target" ]; then
+    # On a 5.x UEK kernel. Installing UEK8 stays inside the kernel-uek lineage, so dnf/grubby
-    log "UEK8 kernel is already the boot default: $target"
+    # (UPDATEDEFAULT=yes) auto-promote it and we do NOT touch grubby. A node still on UEK7
-    exit 0
+    # usually means the kernel repo was empty when it last updated, so populate it and install.
-fi
+    log "running UEK7 kernel ($(uname -r)); the kernel repo was likely not yet populated when"
+    log "this node last updated. Populating it and installing UEK8 -- the update stays on the"
+    log "kernel-uek line, so it becomes the boot default automatically (no grubby change needed)."
+    set_default_kernel_conf
+    ensure_uek8_installed
 
-log "current default kernel: ${current:-unknown}"
+    now="$(grubby --default-kernel 2>/dev/null)"
-log "switching boot default to UEK8 kernel: $target"
+    if [ "$now" = "$INSTALLED_UEK8" ]; then
-grubby --set-default="$target" || { log "ERROR: grubby --set-default failed for $target"; exit 1; }
+        log "boot default auto-promoted to UEK8 kernel: $INSTALLED_UEK8"
+    else
+        log "WARNING: expected the UEK8 kernel to auto-promote but the default is still"
+        log "'${now:-unknown}'. Run 'grubby --set-default=$INSTALLED_UEK8' to force it."
+    fi
+    reboot_notice "$INSTALLED_UEK8"
+    ;;
 
-# Verify the change actually took before claiming success.
+rhck)
-now="$(grubby --default-kernel 2>/dev/null)"
+    # On the stock EL9 kernel (5.14, no UEK installed). Crossing from RHCK into the UEK flavor
-if [ "$now" != "$target" ]; then
+    # does NOT auto-promote -- kernel-install/grubby only auto-promote within the running
-    log "ERROR: default kernel is still '${now:-unknown}' after set-default"
+    # kernel's flavor lineage -- so after installing we must set the boot default explicitly.
-    exit 1
+    log "running stock EL9 (RHCK) kernel ($(uname -r)); installing UEK8 and setting it as the"
-fi
+    log "boot default explicitly (a RHCK->UEK flavor change does not auto-promote)."
+    set_default_kernel_conf
+    ensure_uek8_installed
+    target="$INSTALLED_UEK8"
 
-log "boot default is now $target"
+    current="$(grubby --default-kernel 2>/dev/null)"
-log "REBOOT REQUIRED to start using the UEK8 kernel (currently running $(uname -r))."
+    if [ "$current" = "$target" ]; then
+        log "UEK8 kernel is already the boot default: $target"
+        reboot_notice "$target"
+        exit 0
+    fi
+
+    log "current default kernel: ${current:-unknown}"
+    log "switching boot default to UEK8 kernel: $target"
+    grubby --set-default="$target" || die "grubby --set-default failed for $target"
+
+    # Verify the change actually took before claiming success.
+    now="$(grubby --default-kernel 2>/dev/null)"
+    [ "$now" = "$target" ] || die "default kernel is still '${now:-unknown}' after set-default"
+
+    log "boot default is now $target"
+    reboot_notice "$target"
+    ;;
+esac

salt/common/tools/sbin/so-restart

@@ -5,44 +5,27 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
+
+
+# Usage: so-restart  kibana | playbook 
+
 . /usr/sbin/so-common
 
-usage() {
+if [ $# -ge 1 ]; then
-    echo "Usage: $0 <component> [args]"
-    echo ""
-    echo "Supported args:"
-    echo "  --force | -f          Force stop all Salt jobs before starting component."
-    echo ""
-    echo "Examples:"
-    echo "  $0 kibana             Restart Kibana"
-    echo "  $0 kibana --force     Force stop all Salt jobs before restarting Kibana"
-    exit 1
-}
 
-if [[ $# -lt 1 ]]; then
+        echo $banner
-    usage
+        printf "Restarting $1...\n\nThis could take a while if another Salt job is running. \nRun this command with --force to stop all Salt jobs before proceeding.\n"
+        echo $banner
+
+        if [ "$2" = "--force" ]; then
+                printf "\nForce-stopping all Salt jobs before proceeding\n\n"
+                salt-call saltutil.kill_all_jobs
+        fi
+
+        case $1 in
+                "elastic-fleet") docker stop so-elastic-fleet && docker rm so-elastic-fleet && salt-call state.apply elasticfleet queue=True;;
+                *)  docker stop so-$1 ; docker rm so-$1 ; salt-call state.apply $1 queue=True;;
+        esac
+else
+        echo -e "\nPlease provide an argument by running like so-restart $component, or by using the component-specific script.\nEx. so-restart logstash, or so-logstash-restart\n"
 fi
-
-#shellcheck disable=SC2154
-echo "$banner"
-printf "Restarting %s...\n\nThis could take a while if another Salt job is running. \nRun this command with --force to stop all Salt jobs before proceeding.\n" "$1"
-echo "$banner"
-if [[ "$2" = "--force" ]] || [[ "$2" = "-f" ]]; then
-    printf "\nForce-stopping all Salt jobs before proceeding\n\n"
-    salt-call saltutil.kill_all_jobs
-fi
-case $1 in
-    "elastic-fleet"|"elasticfleet")
-        docker_check_running "elastic-fleet" "--stop"
-        docker rm "so-elastic-fleet" 2> /dev/null
-        # Removing the elastic fleet state directory, so that the next startup re-enrolls with a fresh policy
-        rm -rf /opt/so/conf/elastic-fleet/state
-
-        salt-call state.apply elasticfleet queue=True
-        ;;
-    *)
-        docker_check_running "$1" "--stop"
-        docker rm "so-${1}" 2> /dev/null
-        salt-call state.apply "$1" queue=True
-        ;;
-esac

salt/common/tools/sbin/so-start

@@ -5,54 +5,27 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-# shellcheck disable=SC1091
+
+
+# Usage: so-start  all | kibana | playbook 
+
 . /usr/sbin/so-common
 
-usage() {
+if [ $# -ge 1 ]; then
-    echo "Usage: $0 <component> [args]"
+	echo $banner
-    echo ""
+	printf "Starting $1...\n\nThis could take a while if another Salt job is running. \nRun this command with --force to stop all Salt jobs before proceeding.\n"
-    echo "Supported args:"
+	echo $banner
-    echo "  --force | -f          Force stop all Salt jobs before starting component."
-    echo ""
-    echo "Examples:"
-    echo "  $0 kibana             Start Kibana"
-    echo "  $0 kibana --force     Force stop all Salt jobs before starting Kibana"
-    exit 1
-}
 
-if [[ $# -lt 1 ]]; then
+	if [ "$2" = "--force" ]; then
-    usage
+   		printf "\nForce-stopping all Salt jobs before proceeding\n\n"
+   		salt-call saltutil.kill_all_jobs
+	fi
+
+	case $1 in
+   		"all") salt-call state.highstate queue=True;;
+   		"elastic-fleet") if docker ps | grep -q so-$1; then printf "\n$1 is already running!\n\n"; else docker rm so-$1 >/dev/null 2>&1 ; salt-call state.apply elasticfleet queue=True; fi ;; 
+   		*) if docker ps | grep -E -q '^so-$1$'; then printf "\n$1 is already running\n\n"; else docker rm so-$1 >/dev/null 2>&1 ; salt-call state.apply $1 queue=True; fi ;; 
+	esac
+else
+	echo -e "\nPlease provide an argument by running like so-start $component, or by using the component-specific script.\nEx. so-start logstash, or so-logstash-start\n"	
 fi
-
-#shellcheck disable=SC2154
-echo "$banner"
-printf "Starting %s...\n\nThis could take a while if another Salt job is running. \nRun this command with --force to stop all Salt jobs before proceeding.\n" "$1"
-echo "$banner"
-if [[ "$2" = "--force" ]] || [[ "$2" == "-f" ]]; then
-	printf "\nForce-stopping all Salt jobs before proceeding\n\n"
-	salt-call saltutil.kill_all_jobs
-fi
-
-case "$1" in
-    "all")
-        salt-call state.highstate queue=True
-        ;;
-   	"elastic-fleet"|"elasticfleet")
-        if docker_check_running "elastic-fleet"; then
-            printf "\nso-%s is already running!\n\n" "elastic-fleet"
-            /usr/sbin/so-status
-        else
-            docker rm "so-elastic-fleet" 2> /dev/null
-            salt-call state.apply elasticfleet queue=True
-        fi
-        ;;
-   	*)
-        if docker_check_running "$1"; then
-            printf "\nso-%s is already running\n\n" "$1"
-            /usr/sbin/so-status
-        else
-            docker rm "so-${1}" 2> /dev/null
-            salt-call state.apply "$1" queue=True
-        fi
-        ;;
-esac

salt/common/tools/sbin/so-stop

@@ -5,35 +5,21 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-# shellcheck disable=SC1091
+
+
+# Usage: so-stop kibana | playbook | thehive
+
 . /usr/sbin/so-common
 
-usage() {
+if [ $# -ge 1 ]; then
-    echo "Usage: $0 <component>"
+	echo $banner
-    echo ""
+	printf "Stopping $1...\n"
-    echo "Examples:"
+	echo $banner
-    echo "  $0 kibana             Stop Kibana"
-    exit 1
-}
 
-if [[ $# -lt 1 ]]; then
+	case $1 in
-    usage
+    		*) docker stop so-$1 ; docker rm so-$1 ;;
+	esac
+else
+	echo -e "\nPlease provide an argument by running like so-stop $component, or by using the component-specific script.\nEx. so-stop logstash, or so-logstash-stop\n"	
 fi
 
-
-#shellcheck disable=SC2154
-echo "$banner"
-printf "Stopping %s...\n" "$1"
-echo "$banner"
-case $1 in
-	"elasticfleet"|"elastic-fleet")
-        docker_check_running "elastic-fleet" "--stop"
-        docker rm "so-elastic-fleet" 2> /dev/null
-        # Removing the elastic fleet state directory, so that the next startup re-enrolls with a fresh policy
-        rm -rf /opt/so/conf/elastic-fleet/state
-        ;;
-    *)
-        docker_check_running "$1" "--stop"
-        docker rm "so-${1}" 2> /dev/null
-    ;;
-esac

salt/common/tools/sbin_jinja/so-import-pcap

@@ -63,8 +63,7 @@ function status {
 function pcapinfo() {
   PCAP=$1
   ARGS=$2
-  docker run --rm -v "$PCAP:/input.pcap" --entrypoint capinfos {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-pcaptools:{{ VERSION }} /input.pcap -ae $ARGS |\
+  docker run --rm -v "$PCAP:/input.pcap" --entrypoint capinfos {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-pcaptools:{{ VERSION }} /input.pcap -ae $ARGS
-    sed 's/First packet/Earliest packet/g' | sed 's/Last packet/Latest packet/g'
 }
 
 function pcapfix() {

salt/elasticfleet/config.sls

@@ -173,7 +173,7 @@ eaoptionalintegrationsdir:
 
 {% for minion in node_data %}
 {% set role = node_data[minion]["role"] %}
-{% if role in [ "eval","fleet","import","manager", "managerhype", "managersearch","standalone" ] %}
+{% if role in [ "eval","fleet","heavynode","import","manager", "managerhype", "managersearch","standalone" ] %}
 {% set optional_integrations = ELASTICFLEETMERGED.optional_integrations %}
 {% set integration_keys = optional_integrations.keys() %}
 fleet_server_integrations_{{ minion }}:

salt/elasticfleet/defaults.yaml

@@ -1,5 +1,6 @@
 elasticfleet:
   enabled: False
+  patch_version: 9.3.3+build202604082258 # Elastic Agent specific patch release.
   enable_manager_output: True
   config:
     server:

salt/elasticfleet/enabled.sls

@@ -11,10 +11,6 @@
 
 {#   This value is generated during node install and stored in minion pillar #}
 {%   set SERVICETOKEN = salt['pillar.get']('elasticfleet:config:server:es_token','') %}
-{#   Prevent Elastic Agent from re-enrolling with a new agent.id everytime the container starts up.
-       - if a fresh enrollment is needed use 'so-stop elasticfleet'
-       #}
-{%   set ENROLLED = salt['file.file_exists']('/opt/so/conf/elastic-fleet/state/fleet.enc') %}
 
 include:
   - ca
@@ -69,7 +65,6 @@ so-elastic-fleet:
       - /etc/pki/elasticfleet-server.crt:/etc/pki/elasticfleet-server.crt:ro
       - /etc/pki/elasticfleet-server.key:/etc/pki/elasticfleet-server.key:ro
       - /etc/pki/tls/certs/intca.crt:/etc/pki/tls/certs/intca.crt:ro
-      - /opt/so/conf/elastic-fleet/state:/usr/share/elastic-agent/state
       - /opt/so/log/elasticfleet:/usr/share/elastic-agent/logs 
      {% if DOCKERMERGED.containers['so-elastic-fleet'].custom_bind_mounts %}
         {% for BIND in DOCKERMERGED.containers['so-elastic-fleet'].custom_bind_mounts %}
@@ -77,7 +72,6 @@ so-elastic-fleet:
         {% endfor %}
       {% endif %}      
     - environment:
-      {% if not ENROLLED %}
       - FLEET_SERVER_ENABLE=true
       - FLEET_URL=https://{{ GLOBALS.hostname }}:8220
       - FLEET_SERVER_ELASTICSEARCH_HOST=https://{{ GLOBALS.manager }}:9200
@@ -87,9 +81,6 @@ so-elastic-fleet:
       - FLEET_SERVER_CERT_KEY=/etc/pki/elasticfleet-server.key
       - FLEET_CA=/etc/pki/tls/certs/intca.crt     
       - FLEET_SERVER_ELASTICSEARCH_CA=/etc/pki/tls/certs/intca.crt
-      {% endif %}
-      - STATE_PATH=/usr/share/elastic-agent/state
-      - CONFIG_PATH=/usr/share/elastic-agent/state
       - LOGS_PATH=logs
       {% if DOCKERMERGED.containers['so-elastic-fleet'].extra_env %}
         {% for XTRAENV in DOCKERMERGED.containers['so-elastic-fleet'].extra_env %}
@@ -108,7 +99,6 @@ so-elastic-fleet:
       - x509: etc_elasticfleet_crt
     - require:
       - file: trusttheca
-      - file: eastatedir
       - x509: etc_elasticfleet_key
       - x509: etc_elasticfleet_crt
 

salt/elasticfleet/files/integrations/elastic-defend/elastic-defend-endpoints.json

@@ -5,7 +5,7 @@
   "package": {
     "name": "endpoint",
     "title": "Elastic Defend",
-    "version": "9.3.1",
+    "version": "9.3.0",
     "requires_root": true
   },
   "enabled": true,

salt/elasticfleet/files/integrations/grid-nodes_general/import-evtx-logs.json

@@ -29,7 +29,7 @@
               "\\.gz$"
             ],
             "include_files": [],
-            "processors": "- dissect:\n    tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n    field: \"log.file.path\"\n    target_prefix: \"\"\n- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n- drop_fields:\n    fields: [\"host\"]\n    ignore_missing: true\n- add_fields:\n    target: data_stream\n    fields:\n      type: logs\n      dataset: system.security\n- add_fields:\n    target: event\n    fields:\n      dataset: system.security\n      module: system\n      imported: true\n- add_fields:\n    target: \"@metadata\"\n    fields:\n        pipeline: logs-system.security-2.20.0\n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.sysmon_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.sysmon_operational\n          module: windows\n          imported: true\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.sysmon_operational-3.8.3\n- if:\n    equals:\n      winlog.channel: 'Application'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.application-2.20.0\n- if:\n    equals:\n      winlog.channel: 'System'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.system-2.20.0\n    \n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.powershell_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.powershell_operational\n          module: windows\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.powershell_operational-3.8.3\n- add_fields:\n    target: data_stream\n    fields:\n        dataset: import",
+            "processors": "- dissect:\n    tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n    field: \"log.file.path\"\n    target_prefix: \"\"\n- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n- drop_fields:\n    fields: [\"host\"]\n    ignore_missing: true\n- add_fields:\n    target: data_stream\n    fields:\n      type: logs\n      dataset: system.security\n- add_fields:\n    target: event\n    fields:\n      dataset: system.security\n      module: system\n      imported: true\n- add_fields:\n    target: \"@metadata\"\n    fields:\n        pipeline: logs-system.security-2.15.0\n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.sysmon_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.sysmon_operational\n          module: windows\n          imported: true\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.sysmon_operational-3.8.0\n- if:\n    equals:\n      winlog.channel: 'Application'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.application-2.15.0\n- if:\n    equals:\n      winlog.channel: 'System'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.system-2.15.0\n    \n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.powershell_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.powershell_operational\n          module: windows\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.powershell_operational-3.8.0\n- add_fields:\n    target: data_stream\n    fields:\n        dataset: import",
             "tags": [
               "import"
             ],

salt/elasticfleet/install_agent_grid.sls

@@ -10,15 +10,6 @@
 {% set AGENT_STATUS = salt['service.available']('elastic-agent') %}
 {% set AGENT_EXISTS = salt['file.file_exists']('/opt/Elastic/Agent/elastic-agent') %}
 
-so-elastic-agent-install:
-  file.managed:
-    - name: /usr/sbin/so-elastic-agent-install
-    - source: salt://elasticfleet/tools/sbin/so-elastic-agent-install
-    - user: 947
-    - group: 939
-    - mode: 755
-    - show_changes: False
-
 {% if not AGENT_STATUS or not AGENT_EXISTS %}
 
 pull_agent_installer:
@@ -30,9 +21,11 @@ pull_agent_installer:
 
 run_installer:
   cmd.run:
-    - name: /usr/sbin/so-elastic-agent-install "{{ GRIDNODETOKEN }}"
+    - name: ./so-elastic-agent_linux_amd64 -token={{ GRIDNODETOKEN }} -force
-    - require:
+    - cwd: /opt/so
-      - file: pull_agent_installer
+    - retry:
+        attempts: 3
+        interval: 20
 
 cleanup_agent_installer:
   file.absent:

salt/elasticfleet/manager.sls

@@ -67,6 +67,8 @@ so-elastic-fleet-package-upgrade:
         interval: 30
     - require:
       - http: wait_for_so-kibana
+    - onchanges:
+      - file: /opt/so/state/elastic_fleet_packages.txt
 
 so-elastic-fleet-integrations:
   cmd.run:

salt/elasticfleet/tools/sbin/so-elastic-agent-install

@@ -1,100 +0,0 @@
-#!/bin/bash
-# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
-# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
-# https://securityonion.net/license; you may not use this file except in compliance with the
-# Elastic License 2.0.
-
-. /usr/sbin/so-elastic-fleet-common
-
-
-# passed in as arg from elasticfleet/install_agent_grid.sls, else pulled from pillar later
-GRIDNODETOKEN="$1"
-LOGFILE="/opt/so/SO-Elastic-Agent_Installer_Health.log"
-
-check_agent_health() {
-    timeout=300
-    interval=10
-    start=$SECONDS
-
-    while (( SECONDS - start < timeout )); do
-        agent_status=$(elastic-agent status 2>&1)
-        echo -e "\n$(date)\n$agent_status\n" >> "$LOGFILE"
-        if echo "$agent_status" | grep -A1 'elastic-agent$' | grep -q 'status: (HEALTHY)'; then
-            return 0
-        fi
-        echo "The Elastic Agent is not yet healthy. Waiting for ${interval} seconds before checking again..."
-        sleep "$interval"
-    done
-
-    echo "The Elastic Agent did not become healthy within ${timeout} seconds"
-    return 1
-}
-
-uninstall_agent() {
-    if command -v elastic-agent >/dev/null 2>&1; then
-        elastic-agent uninstall -f
-    fi
-}
-
-if [[ -z "$GRIDNODETOKEN" ]]; then
-    noderole=$(so-yaml.py get -r /etc/salt/grains role)
-    if [[ "$noderole" == "so-heavynode" ]]; then
-        GRIDNODETOKEN=$(salt-call pillar.get global:fleet_grid_enrollment_token_heavy --out=newline_values_only)
-    else
-        GRIDNODETOKEN=$(salt-call pillar.get global:fleet_grid_enrollment_token_general --out=newline_values_only)
-    fi
-fi
-
-if [[ -z "$GRIDNODETOKEN" ]]; then
-    echo "Unable to determine Elastic Fleet enrollment token. Exiting."
-
-    exit 1
-fi
-
-if [[ ! -x /opt/so/so-elastic-agent_linux_amd64 ]]; then
-    echo "Downloading so-elastic-agent installer... This could take a while if another Salt job is running."
-
-    # When running outside of elasticfleet/install_agent_grid.sls we need to download the installer independently.
-    #  PYTHONWARNINGS="ignore" to avoid messages like the following when running salt-call:
-    #  '/opt/saltstack/salt/lib/python3.10/site-packages/salt/transport/base.py:129: TransportWarning: Unclosed transport! <salt.transport.zeromq.RequestClient object at 0x7fc5f0ee7a30>
-    #    File "/bin/salt-call", line 12, in <module>
-    #      sys.exit(salt_call())'
-
-    PYTHONWARNINGS="ignore" salt-call state.single file.managed name=/opt/so/so-elastic-agent_linux_amd64 source=salt://elasticfleet/files/so_agent-installers/so-elastic-agent_linux_amd64 mode=755 makedirs=True queue=True
-
-fi
-
-if [[ -x /opt/so/so-elastic-agent_linux_amd64 ]]; then
-    attempts=0
-    cd /opt/so/ || exit 1
-
-    truncate -s 0 "$LOGFILE"
-
-    uninstall_agent
-
-    while [[ $attempts -lt 3 ]]; do
-        if ./so-elastic-agent_linux_amd64 -token="$GRIDNODETOKEN" -force && echo "Verifying Elastic Agent health..." && check_agent_health; then
-            rm -f /opt/so/so-elastic-agent_linux_amd64
-            elastic-agent status
-
-            exit 0
-        fi
-
-        attempts=$((attempts + 1))
-
-        if [[ $attempts -lt 3 ]]; then
-            echo "Unable to verify Elastic Agent health... Retrying in 20 seconds..."
-            sleep 20
-        fi
-    done
-
-    uninstall_agent
-    rm -f /opt/so/so-elastic-agent_linux_amd64
-    echo "The so-elastic-agent installer failed after 3 attempts. Exiting."
-
-    exit 1
-else
-    echo "Unable to locate so-elastic-agent installer. Exiting."
-
-    exit 1
-fi

salt/elasticfleet/tools/sbin/so-elastic-fleet-integration-policy-load

@@ -9,11 +9,13 @@
 RETURN_CODE=0
 
 if [ ! -f /opt/so/state/eaintegrations.txt ]; then
+  # First, check for any package upgrades
+  /usr/sbin/so-elastic-fleet-package-upgrade
 
-  # update Fleet Server policies
+  # Second, update Fleet Server policies
   /usr/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server
 
-  # configure Elastic Defend Integration separately
+  # Third, configure Elastic Defend Integration seperately
   /usr/sbin/so-elastic-fleet-integration-policy-elastic-defend
 
   # Each group fetches its agent policy once and dispatches create/update writes concurrently.
@@ -30,12 +32,9 @@ if [ ! -f /opt/so/state/eaintegrations.txt ]; then
   elastic_fleet_load_integrations_dir "so-grid-nodes_heavy" \
     /opt/so/conf/elastic-fleet/integrations/grid-nodes_heavy "Grid Nodes Policy_Heavy" || RETURN_CODE=1
 
-  # Fleet Server - Optional integrations (adds integration configuration to a given FleetServer_ policy)
+  # Fleet Server - Optional integrations (one agent policy per FleetServer_* directory)
   for FLEET_DIR in /opt/so/conf/elastic-fleet/integrations-optional/FleetServer*/; do
     [ -d "$FLEET_DIR" ] || continue
-    INTEGRATIONS=("${FLEET_DIR%/}"/*.json)
-    [ -e "${INTEGRATIONS[0]}" ] || continue
-
     FLEET_POLICY=$(basename "$FLEET_DIR")
     elastic_fleet_load_integrations_dir "$FLEET_POLICY" \
       "${FLEET_DIR%/}" "Fleet Server Policy" "elasticsearch-logs" || RETURN_CODE=1

salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers

@@ -30,7 +30,7 @@ done
 if [[ -z $FLEETHOST ]] || [[ -z $ENROLLMENTOKEN ]]; then 
   printf "\nFleet Host URL, Enrollment Token or Elastic Version empty - exiting..."
   printf "\nFleet Host: $FLEETHOST, Enrollment Token: $ENROLLMENTOKEN\n"
-  exit 1
+  exit 
 fi
 
 OSARCH=( "linux-x86_64" "windows-x86_64" "darwin-x86_64" "darwin-aarch64" )
@@ -62,54 +62,31 @@ do
 done 
 
 GOTARGETOS=( "linux" "windows" "darwin" "darwin/arm64" )
+GOARCH="amd64"
 printf "\n### Generating OS packages using the cleaned up tarballs"
-for GOOS in "${GOTARGETOS[@]}"; do
+for GOOS in "${GOTARGETOS[@]}"
-    GOARCH="amd64"
+do
     if [[ $GOOS == 'darwin/arm64' ]]; then GOOS="darwin" && GOARCH="arm64"; fi
     printf "\n\n### Generating $GOOS/$GOARCH Installer...\n"
     docker run -e CGO_ENABLED=0 -e GOOS=$GOOS -e GOARCH=$GOARCH \
     --mount type=bind,source=/etc/pki/tls/certs/,target=/workspace/files/cert/ \
     --mount type=bind,source=/nsm/elastic-agent-workspace/,target=/workspace/files/elastic-agent/ \
-    --mount type=bind,source=/opt/so/saltstack/local/salt/elasticfleet/files/,target=/output/ \
+    --mount type=bind,source=/opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/,target=/output/ \
     {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent-builder:{{ GLOBALS.so_version }} go build -ldflags "-X main.fleetHostURLsList=$FLEETHOST -X main.enrollmentToken=$ENROLLMENTOKEN"  -o /output/so-elastic-agent_${GOOS}_${GOARCH}
     printf "\n### $GOOS/$GOARCH Installer Generated...\n"
 done
 
 printf "\n\n### Generating MSI...\n"
-cp /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_windows_amd64 /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_windows_amd64.exe
+cp /opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/so-elastic-agent_windows_amd64 /opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/so-elastic-agent_windows_amd64.exe
 docker run \
---mount type=bind,source=/opt/so/saltstack/local/salt/elasticfleet/files/,target=/output/ -w /output \
+--mount type=bind,source=/opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/,target=/output/ -w /output \
 {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent-builder:{{ GLOBALS.so_version }} wixl -o so-elastic-agent_windows_amd64_msi --arch x64 /workspace/so-elastic-agent.wxs
 printf "\n### MSI Generated...\n"
 
-# Verify installers were created
-for GOOS in "${GOTARGETOS[@]}"; do
-    GOARCH="amd64"
-    if [[ $GOOS == 'darwin/arm64' ]]; then GOOS="darwin"; GOARCH="arm64"; fi
-    if [[ ! -f /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_${GOOS}_${GOARCH} ]]; then
-        printf "\n### ERROR: Installer for %s/%s was not generated. Exiting...\n" "$GOOS" "$GOARCH"
-        exit 1
-    fi
-    # After verifying new installer was generated, move it to so_agent-installers directory
-    mv /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_${GOOS}_${GOARCH} /opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/
-done
-
-# Verify MSI installer
-if [[ ! -f /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_windows_amd64_msi ]]; then
-    printf "\n### ERROR: Installer MSI was not generated. Exiting...\n"
-    exit 1
-else
-    # After verifying new installer MSI was generated, move it to so_agent-installers directory
-    mv /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_windows_amd64_msi /opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/
-fi
-
 printf "\n### Cleaning up temp files \n"
 rm -rf /nsm/elastic-agent-workspace
-rm -rf /opt/so/saltstack/local/salt/elasticfleet/files/so-elastic-agent_windows_amd64.exe
+rm -rf /opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/so-elastic-agent_windows_amd64.exe
 
 printf "\n### Copying so_agent-installers to /nsm/elastic-fleet/ for nginx.\n"
 \cp -vr /opt/so/saltstack/local/salt/elasticfleet/files/so_agent-installers/ /nsm/elastic-fleet/
 chmod 644 /nsm/elastic-fleet/so_agent-installers/*
-
-# if we got here all installers have been generated successfully
-exit 0

salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade

@@ -12,22 +12,17 @@ PKG_LOAD_FAILURES=0
 PKG_LOAD_FAILURES_NAMES=()
 
 {%- for PACKAGE in SUPPORTED_PACKAGES %}
-if INSTALLED_VERSION=$(elastic_fleet_package_version_check "{{ PACKAGE }}") && LATEST_VERSION=$(elastic_fleet_package_latest_version_check "{{ PACKAGE }}"); then
+echo "Upgrading {{ PACKAGE }} package..."
-
+if VERSION=$(elastic_fleet_package_latest_version_check "{{ PACKAGE }}"); then
-    if [ "$INSTALLED_VERSION" == "$LATEST_VERSION" ]; then
+    if ! elastic_fleet_package_install "{{ PACKAGE }}" "$VERSION"; then
-        echo "{{ PACKAGE }} integration version $INSTALLED_VERSION is already at the reported latest version $LATEST_VERSION, skipping upgrade."
+        PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
-    else
+        PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")
-        echo "Upgrading {{ PACKAGE }} package to version $LATEST_VERSION..."
-        if ! elastic_fleet_package_install "{{ PACKAGE }}" "$LATEST_VERSION"; then
-            PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
-            PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")
-        fi
     fi
 else
-    echo "ERROR: Failed to get version information for integration {{ PACKAGE }}"
     PKG_LOAD_FAILURES=$((PKG_LOAD_FAILURES + 1))
     PKG_LOAD_FAILURES_NAMES+=("{{ PACKAGE }}")
 fi
+echo
 {%- endfor %}
 
 if [ $PKG_LOAD_FAILURES -gt 0 ]; then
@@ -40,3 +35,6 @@ if [ $PKG_LOAD_FAILURES -gt 0 ]; then
 else
     echo "Successfully upgraded all packages."
 fi
+
+echo
+/usr/sbin/so-elasticsearch-templates-load

salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-setup

@@ -181,9 +181,6 @@ if ! elastic_fleet_policy_create "so-grid-nodes_heavy" "SO Grid Nodes - Heavy No
     exit 1
 fi
 
-# Check for package upgrades
-so-elastic-fleet-package-upgrade
-
 # Load Integrations for default policies
 so-elastic-fleet-integration-policy-load
 
@@ -244,34 +241,11 @@ printf '%s\n'\
     "" >> "$global_pillar_file"
 
 # Call Elastic-Fleet Salt State
-printf "\nApplying elasticfleet state\n"
+printf "\nApplying elasticfleet state"
-for state_attempt in {1..3}; do
+salt-call state.apply elasticfleet queue=True
-    if salt-call state.apply elasticfleet queue=True; then
-        break
-    elif [[ $state_attempt -lt 3 ]]; then
-        printf "\nElasticfleet state did not complete successfully... Attempt (%s/3). Retrying...\n" "$state_attempt"
-        sleep 10
-    else
-        printf "\nFailure(s) in elasticfleet state... Exiting...\n"
-        exit 1
-    fi
-done
 
 # Generate installers & install Elastic Agent on the node
-for agent_gen_attempt in {1..3}; do
+so-elastic-agent-gen-installers
-    if so-elastic-agent-gen-installers; then
+printf "\nApplying elasticfleet.install_agent_grid state"
-        break
+salt-call state.apply elasticfleet.install_agent_grid queue=True
-    elif [[ $agent_gen_attempt -lt 3 ]]; then
+exit 0
-        printf "\nUnable to generate Elastic Agent installers... Attempt (%s/3). Retrying...\n" "$agent_gen_attempt"
-        sleep 10
-    else
-        printf "\nFailed to generate Elastic Agent installers after 3 attempts. Exiting...\n"
-        exit 1
-    fi
-done
-
-printf "\nApplying elasticfleet.install_agent_grid state\n"
-if ! salt-call state.apply elasticfleet.install_agent_grid queue=True; then
-    printf "\nFailure(s) in elasticfleet.install_agent_grid state... Exiting...\n"
-    exit 1
-fi

salt/elasticsearch/defaults.yaml

@@ -1,6 +1,6 @@
 elasticsearch:
   enabled: false
-  version: 9.3.7
+  version: 9.3.3
   index_clean: true
   data_retention_method: DLM
   vm:

salt/elasticsearch/files/ingest/logs-pfsense.log-1.25.2

@@ -118,70 +118,70 @@
     {
       "pipeline": {
         "tag": "pipeline_e16851a7",
-        "name": "logs-pfsense.log-1.25.4-firewall",
+        "name": "logs-pfsense.log-1.25.2-firewall",
         "if": "ctx.event.provider == 'filterlog'"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_828590b5",
-        "name": "logs-pfsense.log-1.25.4-openvpn",
+        "name": "logs-pfsense.log-1.25.2-openvpn",
         "if": "ctx.event.provider == 'openvpn'"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_9d37039c",
-        "name": "logs-pfsense.log-1.25.4-ipsec",
+        "name": "logs-pfsense.log-1.25.2-ipsec",
         "if": "ctx.event.provider == 'charon'"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_ad56bbca",
-        "name": "logs-pfsense.log-1.25.4-dhcp",
+        "name": "logs-pfsense.log-1.25.2-dhcp",
         "if": "[\"dhcpd\", \"dhclient\", \"dhcp6c\", \"dnsmasq-dhcp\"].contains(ctx.event.provider)"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_dd85553d",
-        "name": "logs-pfsense.log-1.25.4-unbound",
+        "name": "logs-pfsense.log-1.25.2-unbound",
         "if": "ctx.event.provider == 'unbound'"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_720ed255",
-        "name": "logs-pfsense.log-1.25.4-haproxy",
+        "name": "logs-pfsense.log-1.25.2-haproxy",
         "if": "ctx.event.provider == 'haproxy'"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_456beba5",
-        "name": "logs-pfsense.log-1.25.4-php-fpm",
+        "name": "logs-pfsense.log-1.25.2-php-fpm",
         "if": "ctx.event.provider == 'php-fpm'"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_a0d89375",
-        "name": "logs-pfsense.log-1.25.4-squid",
+        "name": "logs-pfsense.log-1.25.2-squid",
         "if": "ctx.event.provider == 'squid'"
       }
     },
     {
       "pipeline": {
         "tag": "pipeline_c2f1ed55",
-        "name": "logs-pfsense.log-1.25.4-snort",
+        "name": "logs-pfsense.log-1.25.2-snort",
         "if": "ctx.event.provider == 'snort'"
       }
     },
     {
       "pipeline": {
         "tag":"pipeline_33db1c9e",
-        "name": "logs-pfsense.log-1.25.4-suricata",
+        "name": "logs-pfsense.log-1.25.2-suricata",
         "if": "ctx.event.provider == 'suricata'"
       }
     },

salt/elasticsearch/files/ingest/zeek.ssl

@@ -5,7 +5,6 @@
     { "remove":   { "field": ["host"],     "ignore_failure": true } },
     { "json":             { "field": "message",                 "target_field": "message2",             "ignore_failure": true  } },
     { "rename":         { "field": "message2.version",          "target_field": "ssl.version",          "ignore_missing": true  } },
-    { "set":      { "description": "Set transport for the community_id processor", "if": "ctx.ssl?.version == null || !ctx.ssl.version.startsWith('DTLS')", "field": "network.transport", "value": "tcp", "ignore_failure": true } },
     { "rename":         { "field": "message2.cipher",           "target_field": "ssl.cipher",           "ignore_missing": true  } },
     { "rename":         { "field": "message2.curve",            "target_field": "ssl.curve",            "ignore_missing": true  } },
     { "rename":         { "field": "message2.server_name",      "target_field": "ssl.server_name",              "ignore_missing": true  } },

salt/elasticsearch/soc_elasticsearch.yaml

@@ -645,7 +645,6 @@ elasticsearch:
             global: True
             advanced: True
             helpLink: elasticsearch
-    so-logs-soc: *dataStreamSettings
     so-logs-system_x_auth: *dataStreamSettings
     so-logs-system_x_syslog: *dataStreamSettings
     so-logs-system_x_system: *dataStreamSettings

salt/kibana/defaults.yaml

@@ -22,7 +22,7 @@ kibana:
           - default
           - file
     migrations:
-      discardCorruptObjects: "9.3.7"
+      discardCorruptObjects: "9.3.3"
     telemetry:
       enabled: False
     xpack:

salt/kibana/enabled.sls

@@ -69,7 +69,7 @@ wait_for_so-kibana:
     - ssl: True
     - verify_ssl: False
     - status: 200
-    - wait_for: 600
+    - wait_for: 300
     - request_interval: 15
     - require:
       - docker_container: so-kibana

salt/manager/tools/sbin/soup

@@ -245,7 +245,6 @@ check_airgap() {
       UPDATE_DIR=/tmp/soagupdate/SecurityOnion
       AGDOCKER=/tmp/soagupdate/docker
       AGREPO=/tmp/soagupdate/minimal/Packages
-      AGUEKREPO=/tmp/soagupdate/uek/Packages
   else
       is_airgap=1
   fi
@@ -740,6 +739,7 @@ fix_logstash_0013_lumberjack_pipeline_name() {
 up_to_3.1.0() {
   ensure_postgres_local_pillar
   ensure_postgres_secret
+  determine_elastic_agent_upgrade
   elasticsearch_backup_index_templates
   # Clear existing component template state file.
   rm -f /opt/so/state/esfleet_component_templates.json
@@ -783,23 +783,12 @@ post_to_3.1.0() {
 
 ### 3.2.0 Scripts ###
 
-recollate_postgres() {
-  echo ""
-  echo "Recollating PostgreSQL databases. The following output may contain warnings about a version mismatch, followed by a note indicating that the collation version has been changed."
-  for db in postgres securityonion so_telegraf; do
-    docker exec so-postgres psql -U postgres $db -c "reindex database $db"
-    docker exec so-postgres psql -U postgres $db -c "alter database $db refresh collation version"
-  done
-  echo "Recollating PostgreSQL databases complete."
-  echo ""
-}
-
 bootstrap_so_soc_database() {
   # init-db.sh is mounted into so-postgres at /docker-entrypoint-initdb.d/init-db.sh
   # and runs automatically only on a fresh data directory. Hosts upgrading from
   # 3.1.0 already have /nsm/postgres populated, so the so_soc bootstrap block
   # added in 3.2 never fires. Re-run the script explicitly; it's idempotent.
-  echo "Bootstrapping database via init-db.sh."
+  echo "Bootstrapping so_soc database via init-db.sh."
   # The postgres image has no USER directive, so `docker exec` defaults to
   # root, and the container env intentionally omits POSTGRES_USER (the upstream
   # entrypoint defaults it transiently during first-init only). Recreate both
@@ -810,13 +799,10 @@ bootstrap_so_soc_database() {
     return 0
   fi
   if ! $exec_cmd; then
-    FINAL_MESSAGE_QUEUE+=("WARNING: init-db.sh failed inside so-postgres during the 3.2.0 upgrade; the database may not have been bootstrapped. Re-run manually: $exec_cmd")
+    FINAL_MESSAGE_QUEUE+=("WARNING: init-db.sh failed inside so-postgres during the 3.2.0 upgrade; the so_soc database may not have been bootstrapped. Re-run manually: $exec_cmd")
     return 0
   fi
-  echo "Database bootstrap complete."
+  echo "so_soc bootstrap complete."
-
-  echo "Restarting so-soc container to pick up database changes"
-  docker restart so-soc
 }
 
 # Existing grids should keep ILM unless an admin explicitly opts in to DLM.
@@ -864,32 +850,7 @@ kibana_backport_streams_index_template() {
 
 }
 
-# Runs kafka-features.sh upgrade --release-version $1
-#   Upgrades Kafka KRaft cluster metadata
-update_kafka_metadata() {
-    metadata_version="$1"
-    global_pillar="/opt/so/saltstack/local/pillar/global/soc_global.sls"
-    if PIPELINE=$(so-yaml.py get -r "$global_pillar" global.pipeline 2> /dev/null) && [[ "$PIPELINE" == "KAFKA" ]]; then
-        kafka_nodes_raw=$(salt-call pillar.get kafka:nodes --out=json)
-        if kafka_nodes=$(jq -er '.local | select(type == "object" and length > 0)' <<< "$kafka_nodes_raw"); then
-            bootstrap_servers=$(jq -r '[to_entries[] | select(.value.role | contains("broker")) | "\(.value.ip):9092"] | join(",")' <<< "$kafka_nodes")
-            echo "Upgrading Kafka KRaft cluster version"
-            so-kafka-cli kafka-features.sh --bootstrap-server "$bootstrap_servers" --command-config /opt/kafka/config/kraft/client.properties upgrade --release-version "$metadata_version" 2>/dev/null || true
-
-            return 0
-        else
-            FINAL_MESSAGE_QUEUE+=("WARNING: Unable to automatically perform Kafka KRaft cluster metadata update. This step can be performed manually using the following command (replacing \$BROKER_IP with the ip of atleast 1 available Kafka broker):")
-            FINAL_MESSAGE_QUEUE+=("    - so-kafka-cli kafka-features.sh --bootstrap-server \$BROKER_IP:9092 --command-config /opt/kafka/config/kraft/client.properties upgrade --release-version $metadata_version")
-        fi
-    else
-        echo "Nothing to do!"
-    fi
-}
-
 up_to_3.2.0() {
-  # download 9.3.7 elastic agent packages
-  determine_elastic_agent_upgrade
-
   fix_logstash_0013_lumberjack_pipeline_name
 
   pin_elasticsearch_data_retention_method
@@ -898,19 +859,14 @@ up_to_3.2.0() {
 }
 
 post_to_3.2.0() {
-  # Recollate due to image OS rebase
-  recollate_postgres
-
   bootstrap_so_soc_database
 
-  # Generate 9.3.7 elastic agent installers
+  # Including agent regen script here since it was missed in post_to_3.1.0
   echo "Regenerating Elastic Agent Installers"
   /sbin/so-elastic-agent-gen-installers
 
   kibana_backport_streams_index_template
 
-  update_kafka_metadata "4.3"
-
   POSTVERSION=3.2.0
 }
 
@@ -1024,19 +980,13 @@ update_airgap_rules() {
   rsync -a $UPDATE_DIR/agrules/securityonion-resources/* /nsm/securityonion-resources/
 }
 
-update_airgap_repos() {
+update_airgap_repo() {
   # Update the files in the repo
-  echo "Syncing new updates to /nsm/repo & /nsm/kernelrepo"
+  echo "Syncing new updates to /nsm/repo"
-  # Airgap soup copies new files into the local repo, but doesn't remove old packages. Retaining the ability to rollback package updates
+  rsync -a $AGREPO/* /nsm/repo/
-  rsync -a "$AGREPO"/ /nsm/repo/
+  echo "Creating repo"
-  rsync -a "$AGUEKREPO"/ /nsm/kernelrepo/
-
   dnf -y install yum-utils createrepo_c
-
-  echo "Running createrepo for /nsm/repo"
   createrepo /nsm/repo
-  echo "Running createrepo for /nsm/kernelrepo"
-  createrepo /nsm/kernelrepo
 }
 
 update_salt_mine() {
@@ -1176,8 +1126,7 @@ verify_es_version_compatibility() {
         ["8.18.4"]="8.18.6 8.18.8 9.0.8"
 	    ["8.18.6"]="8.18.8 9.0.8"
 	    ["8.18.8"]="9.0.8"
-        ["9.0.8"]="9.3.3 9.3.7"
+        ["9.0.8"]="9.3.3"
-        ["9.3.3"]="9.3.7"
     )
 
     # Elasticsearch MUST upgrade through these versions
@@ -1793,7 +1742,7 @@ main() {
   set -e
 
   if [[ $is_airgap -eq 0 ]]; then
-    update_airgap_repos
+    update_airgap_repo
     dnf clean all
     check_os_updates
   elif [[ $OS == 'oracle' ]]; then

salt/soc/config.sls

@@ -134,30 +134,6 @@ socsigmasopipeline:
     - group: 939
     - mode: 600
 
-socsigmaplaybookpipeline:
-  file.managed:
-    - name: /opt/so/conf/soc/sigma_playbook_pipeline.yaml
-    - source: salt://soc/files/soc/sigma_playbook_pipeline.yaml
-    - user: 939
-    - group: 939
-    - mode: 600
-
-socplaybookplaceholdermap:
-  file.managed:
-    - name: /opt/so/conf/soc/playbook_placeholder_map.yaml
-    - source: salt://soc/files/soc/playbook_placeholder_map.yaml
-    - user: 939
-    - group: 939
-    - mode: 600
-
-socplaybookplaceholdermapcustom:
-  file.managed:
-    - name: /opt/so/conf/soc/playbook_placeholder_map_custom.yaml
-    - source: salt://soc/files/soc/playbook_placeholder_map_custom.yaml
-    - user: 939
-    - group: 939
-    - mode: 600
-
 socbanner:
   file.managed:
     - name: /opt/so/conf/soc/banner.md

salt/soc/defaults.yaml

@@ -1500,23 +1500,15 @@ soc:
           playbookRepos:
             default:
               - repo: https://github.com/Security-Onion-Solutions/securityonion-resources-playbooks
-                rulesetName: sos-playbook-resources
                 branch: main
                 folder: securityonion-normalized
-              - repo: https://github.com/Security-Onion-Solutions/securityonion-resources-playbooks
-                rulesetName: sos-published
-                branch: published
-                folder: sigma
             airgap:
               - repo: file:///nsm/airgap-resources/playbooks/securityonion-resources-playbooks
-                rulesetName: sos-resources-ag
                 branch: main
                 folder: securityonion-normalized
         assistant:
           systemPromptAddendum: ""
           systemPromptAddendumMaxLength: 50000
-          maxSubSessionTokens: 0
-          maxDelegationDepth: 5
           adapters:
             - name: SOAI
               protocol: securityonion_ai_cloud
@@ -1528,10 +1520,6 @@ soc:
               serviceAccountJSON: ""
               serviceAccountLocation: ""
               healthTimeoutSeconds: 5
-          agentic: false
-          agentMapping:
-            Orchestrator: sonnet
-            Hunter: sonnet
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false
@@ -1783,13 +1771,13 @@ soc:
               enabled: true
           queries:
             - name: Default Query
-              description: Show all events grouped by module and dataset
-              query: '* | groupby event.module* event.dataset'
-              showSubtitle: true
-            - name: Observer
               description: Show all events grouped by the observer host
               query: '* | groupby observer.name'
               showSubtitle: true
+            - name: Log Type
+              description: Show all events grouped by module and dataset
+              query: '* | groupby event.module* event.dataset'
+              showSubtitle: true
             - name: SOC - Auth
               description: Users authenticated to SOC grouped by IP address and identity
               query: 'event.dataset:kratos.audit AND msg:*authenticated* | groupby http.request.headers.x-real-ip user.name'
@@ -2701,8 +2689,6 @@ soc:
           thresholdColorRatioLow: 0.5
           thresholdColorRatioMed: 0.75
           thresholdColorRatioMax: 1
-          toolBusyMaxRetries: 30
-          toolBusyRetryDelayMs: 1000
           availableModels:
             - id: sonnet
               displayName: Claude Sonnet

salt/soc/enabled.sls

@@ -45,10 +45,7 @@ so-soc:
       - /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro
       - /opt/so/conf/soc/banner.md:/opt/sensoroni/html/login/banner.md:ro
       - /opt/so/conf/soc/sigma_so_pipeline.yaml:/opt/sensoroni/sigma_so_pipeline.yaml:ro
-      - /opt/so/conf/soc/sigma_playbook_pipeline.yaml:/opt/sensoroni/sigma_playbook_pipeline.yaml:ro
+      - /opt/so/conf/soc/sigma_final_pipeline.yaml:/opt/sensoroni/sigma_final_pipeline.yaml:rw
-      - /opt/so/conf/soc/sigma_final_pipeline.yaml:/opt/sensoroni/sigma_final_pipeline.yaml:ro
-      - /opt/so/conf/soc/playbook_placeholder_map.yaml:/opt/sensoroni/playbook_placeholder_map.yaml:ro
-      - /opt/so/conf/soc/playbook_placeholder_map_custom.yaml:/opt/sensoroni/playbook_placeholder_map_custom.yaml:ro
       - /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro
       - /opt/so/conf/soc/custom_roles:/opt/sensoroni/rbac/custom_roles:ro
       - /opt/so/conf/soc/soc_users_roles:/opt/sensoroni/rbac/users_roles:rw
@@ -102,8 +99,6 @@ so-soc:
       - file: soccustomroles
       - file: socusersroles
       - file: socclientsroles
-      - file: socplaybookplaceholdermap
-      - file: socplaybookplaceholdermapcustom
 
 delete_so-soc_so-status.disabled:
   file.uncomment:

salt/soc/files/soc/playbook_placeholder_map.yaml

@@ -1,49 +0,0 @@
-# Global Playbook placeholder map: %token% -> event field path.
-#
-# Loaded by the SOC Playbook module and used to resolve `field|expand:%placeholder%` values 
-# from an alert when converting playbook questions to OQL. 
-# Left: the %token% used in a question
-# Right: the event field its value is read from (event_data.-nested or bare; the module
-# tries both). 
-#
-# Example: with `src_ip: source.ip` (below), a question that writes
-# `source.ip|expand: '%src_ip%'` resolves %src_ip% to the alert's source.ip at convert time.
-#
-# This is the global base layer. To add or override tokens edit playbook_placeholder_map_custom.yaml.
-# those entries overlay this map and win on conflict.
-
-CommandLine: process.command_line
-CurrentDirectory: process.working_directory
-Image: process.executable
-ImageLoaded: dll.name
-ParentImage: process.parent.executable
-ParentName: process.parent.name
-ParentProcessGuid: process.parent.entity_id
-ProcessGuid: process.entity_id
-TargetFilename: file.name
-TargetObject: registry.path
-TargetUserName: user.target.name
-User: user.name
-community_id: network.community_id
-dns_resolved_ip: dns.resolved_ip
-document_id: soc_id
-dst_ip: destination.ip
-dst_port: destination.port
-event_data_source_ip: source.ip
-file_path: file.path
-file_dirs: process.file_dirs
-file_name: process.name
-file_paths: process.file_paths
-hostname: host.name
-private_ip: network.private_ip
-public_ip: network.public_ip
-related_hosts: related.hosts
-related_ip: related.ip
-src_ip: source.ip
-dns_query_name: dns.query_name
-flow_id: log.id.uid
-payload: network.data.decoded
-rule_category: rule.category
-rule_name: rule.name
-rule_uuid: rule.uuid
-src_port: source.port

salt/soc/files/soc/playbook_placeholder_map_custom.yaml

@@ -1,14 +0,0 @@
-# Custom Playbook placeholder map: %token% -> event field path.
-#
-#
-# Left: the %token% used in a playbook question.
-# Right: the event field its value is read from (event_data.-nested or bare; the module tries
-# both). Note: a token that is simply named after a flat event field resolves automatically
-# without an entry here - only add a mapping when the token name differs from the field name.
-#
-# Example:
-#
-# account_id: cloudflare.account_id
-#
-# A question that writes
-# `account_id|expand: '%account_id%'` resolves %account_id% from the alert at convert time.

salt/soc/files/soc/sigma_playbook_pipeline.yaml

@@ -1,12 +0,0 @@
-name: Security Onion - Playbook Pipeline
-priority: 97
-transformations:
-    # Route string fields to their lowercase-normalized .caseless subfield so wildcard
-    # matches are case-insensitive.
-    - id: case_insensitive_string_fields
-      type: field_name_mapping
-      mapping:
-        process.executable: process.executable.caseless
-        process.parent.executable: process.parent.executable.caseless
-        process.command_line: process.command_line.caseless
-        process.parent.command_line: process.parent.command_line.caseless

salt/soc/files/soc/sigma_so_pipeline.yaml

@@ -63,14 +63,6 @@ transformations:
       rule_conditions:
       - type: logsource
         category: antivirus
-    # OS-agnostic process_creation scoping for product-less (NIDS/host-pivot) rules.
-    - id: process_creation_os_agnostic
-      type: add_condition
-      conditions:
-        event.category: process
-      rule_conditions:
-      - type: logsource
-        category: process_creation
     # Transforms the `Hashes` field to ECS fields
     # ECS fields are used by the hash fields emitted by Elastic Defend
     # If shipped with Elastic Agent, sysmon logs will also have hashes mapped to ECS fields    
@@ -116,40 +108,6 @@ transformations:
       - type: logsource
         product: windows
         category: driver_load
-    - id: ecs_fix_process_creation
-      type: field_name_mapping
-      mapping:
-        # bare `Hashes` (the combined-string case is broken out above)
-        winlog.event_data.Hashes: process.hash.sha256
-        winlog.event_data.IntegrityLevel: process.Ext.token.integrity_level_name
-        winlog.event_data.ParentName: process.parent.name
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: process_creation
-    - id: ecs_fix_registry_set
-      type: field_name_mapping
-      mapping:
-        winlog.event_data.Details: registry.data.strings
-        # field rename only; EventType values (SetValue/CreateKey) still differ from
-        # event.action values (modification/creation)
-        winlog.event_data.EventType: event.action
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: registry_set
-    - id: ecs_fix_image_load
-      type: field_name_mapping
-      mapping:
-        file.path: dll.path
-        file.code_signature.signed: dll.code_signature.exists
-        winlog.event_data.Signature: dll.code_signature.subject_name
-        file.code_signature.status: dll.code_signature.status
-        winlog.event_data.Hashes: dll.hash.sha256
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: image_load
     - id: linux_security_add-fields
       type: add_condition
       conditions:
@@ -323,15 +281,6 @@ transformations:
       rule_conditions:
       - type: logsource
         category: file_event
-    # Scope image_load rules to Elastic Endpoint library events (event.category:library, dll.*
-    # populated).
-    - id: endpoint_image_load_add-fields
-      type: add_condition
-      conditions:
-        event.category: 'library'
-      rule_conditions:
-      - type: logsource
-        category: image_load
     # Maps network rules to all network logs
     # This targets all network logs, all services, generated from endpoints and network
     - id: network_add-fields

salt/soc/soc_soc.yaml

@@ -46,15 +46,7 @@ soc:
         syntax: yaml
         file: True
         global: True
-        advanced: False
+        advanced: True
-        helpLink: security-onion-console-customization
-      playbook_placeholder_map_custom__yaml:
-        title: Playbook Placeholder Map
-        description: Custom mappings of Playbook %placeholder% tokens to event fields.
-        syntax: yaml
-        file: True
-        global: True
-        advanced: False
         helpLink: security-onion-console-customization
   config:
     licenseKey:
@@ -727,16 +719,6 @@ soc:
             description: Maximum length of the system prompt addendum. Longer prompts will be truncated.
             global: True
             advanced: True
-          maxSubSessionTokens:
-            description: Maximum number of output tokens a delegated sub-session may generate across all of its turns. When the budget is reached, the sub-agent is halted and its result is returned to the parent agent. Set to 0 to disable the limit.
-            global: True
-            advanced: True
-            forcedType: int
-          maxDelegationDepth:
-            description: Maximum delegation nesting depth for sub-agents. For example, a value of 2 lets the main agent delegate to a sub-agent that may itself delegate one level deeper. Any deeper delegation is refused and the requesting agent continues without it. Set to 0 to disable the limit.
-            global: True
-            advanced: True
-            forcedType: int
           adapters:
             description: Configuration for AI adapters used by the Onion AI assistant. Please see documentation for help on which fields are required for which protocols.
             global: True
@@ -775,29 +757,12 @@ soc:
               label: Health Timeout Seconds
               required: False
               forcedType: int
-          agentic:
-            description: Indicates if the Assistant Module should operate in agentic mode or not. If true, agents can work together to solve tasks.
-            global: True
-            forcedType: bool
-          agentMapping:
-            Orchestrator:
-              description: The initial agent in most agentic conversations. This agent will delegate requests to specialized agents.
-              global: True
-            Hunter:
-              description: This agent is specialized in querying events.
-              global: True
       client:
         assistant:
           enabled:
             description: Set to true to enable the Onion AI assistant in SOC.
             global: True
             forcedType: bool
-          toolBusyMaxRetries:
-            description: How many times to retry auto approving a tool while a tool is already running.
-            global: True
-          toolBusyRetryDelayMs:
-            description: How long in milliseconds to wait between each retry when auto approving a tool.
-            global: True
           investigationPrompt: 
             description: Prompt given to Onion AI when beginning an investigation.
             global: True

salt/suricata/enabled.sls

@@ -69,7 +69,6 @@ surirulereload:
     - name: /usr/sbin/so-suricata-reload-rules >> /opt/so/log/suricata/reload.log 2>&1
     - onchanges: 
         - file: surirulesync
-    - onlyif: test -f /opt/so/rules/suricata/all-rulesets.rules
     - require:
         - docker_container: so-suricata
     

salt/suricata/tools/sbin/so-suricata-reload-rules

@@ -7,59 +7,5 @@
 
 . /usr/sbin/so-common
 
-RULES_FILE="/opt/so/rules/suricata/all-rulesets.rules"
+retry 60 3 'docker exec so-suricata /opt/suricata/bin/suricatasc -c reload-rules /var/run/suricata/suricata-command.socket' '{"message":"done","return":"OK"}' || fail "The Suricata container was not ready in time."
-SOCKET="/var/run/suricata/suricata-command.socket"
+retry 60 3 'docker exec so-suricata /opt/suricata/bin/suricatasc -c ruleset-reload-nonblocking /var/run/suricata/suricata-command.socket' '{"message":"done","return":"OK"}' || fail "The Suricata container was not ready in time."
-SURICATASC="docker exec so-suricata /opt/suricata/bin/suricatasc"
-
-# Format an epoch as a human-readable local timestamp for log messages.
-fmt_time() { date -d "@$1" '+%Y-%m-%d %H:%M:%S %Z' 2>/dev/null; }
-
-# Prefix each input line with the current timestamp.
-timestamp_lines() { while IFS= read -r line; do printf '%s %s\n' "$(date '+%Y-%m-%d %H:%M:%S %Z')" "$line"; done; }
-
-# Epoch of Suricata's last *completed* ruleset reload; non-zero return on failure.
-suricata_reload_epoch() {
-  local out ts
-  out=$($SURICATASC -c ruleset-reload-time "$SOCKET" 2>/dev/null)
-  ts=$(echo "$out" | jq -r '.message[0].last_reload // empty' 2>/dev/null)
-  [ -n "$ts" ] || return 1
-  date -d "$ts" +%s 2>/dev/null
-}
-
-# Trigger a fresh reload and confirm Suricata is running a ruleset at least as new
-# as the rules file. Returns 0 only when both hold, so retry keeps going until an
-# in-progress reload clears and our own reload completes.
-reload_and_verify() {
-  local out reload_epoch
-  out=$($SURICATASC -c reload-rules "$SOCKET")
-  echo "reload-rules: $out"
-
-  if [[ "$out" =~ "Reload already in progress" ]]; then
-    echo "A reload is already in progress; waiting for it to clear so a fresh reload can load the current ruleset."
-    return 1
-  fi
-  if [[ ! "$out" =~ '{"message":"done","return":"OK"}' ]]; then
-    echo "Suricata not ready or unexpected reload output; will retry."
-    return 1
-  fi
-
-  reload_epoch=$(suricata_reload_epoch) || { echo "Could not read ruleset-reload-time; will retry."; return 1; }
-  if [ "$reload_epoch" -ge "$target_mtime" ]; then
-    echo "Loaded ruleset is current: last reload ($(fmt_time "$reload_epoch")) is newer than rules file ($(fmt_time "$target_mtime"))."
-    return 0
-  fi
-  echo "Loaded ruleset is stale: last reload ($(fmt_time "$reload_epoch")) is older than rules file ($(fmt_time "$target_mtime")); retrying."
-  return 1
-}
-
-# Run the reload/verify, timestamping every line of output (ours and the
-# retry/fail helpers') so reload.log shows when each step ran. The pipeline is
-# synchronous, so the log is fully flushed and ordered before we exit; the
-# script's real exit code is preserved via PIPESTATUS.
-{
-  # Epoch mtime of the ruleset we need Suricata to have loaded. Captured once so
-  # a file update mid-reload does not move the goalpost.
-  target_mtime=$(stat -c %Y "$RULES_FILE") || fail "Could not stat the Suricata rules file: $RULES_FILE"
-  retry 60 3 'reload_and_verify' || fail "Suricata did not load the current ruleset in time."
-} 2>&1 | timestamp_lines
-exit "${PIPESTATUS[0]}"

salt/telegraf/etc/telegraf.conf

@@ -244,7 +244,6 @@
   username = "{{ ES_USER }}"
   password = "{{ ES_PASS }}"
   insecure_skip_verify = true
-  cluster_health = true
 {%- elif grains['role'] in ['so-searchnode']  %}
 [[inputs.elasticsearch]]
   servers = ["https://{{ NODEIP }}:9200"]

salt/top.sls

@@ -83,6 +83,7 @@ base:
     - zeek
     - strelka
     - elastalert
+    - utility
     - elasticfleet
     - pcap.cleanup
 
@@ -112,6 +113,7 @@ base:
     - zeek
     - strelka
     - elastalert
+    - utility
     - elasticfleet
     - stig
     - kafka
@@ -139,6 +141,7 @@ base:
     - elastic-fleet-package-registry
     - kibana
     - elastalert
+    - utility
     - elasticfleet
     - stig
     - kafka
@@ -165,6 +168,7 @@ base:
     - elastic-fleet-package-registry
     - kibana
     - elastalert
+    - utility
     - elasticfleet
     - kafka
 
@@ -194,6 +198,7 @@ base:
     - elastic-fleet-package-registry
     - kibana
     - elastalert
+    - utility
     - elasticfleet
     - stig
     - kafka
@@ -217,6 +222,7 @@ base:
     - elasticsearch
     - elastic-fleet-package-registry
     - kibana
+    - utility
     - suricata
     - zeek
     - elasticfleet

salt/utility/bin/eval

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Wait for ElasticSearch to come up, so that we can query for version infromation
+echo -n "Waiting for ElasticSearch..."
+COUNT=0
+ELASTICSEARCH_CONNECTED="no"
+while [[ "$COUNT" -le 30 ]]; do
+  curl -K /opt/so/conf/elasticsearch/curl.config -k --output /dev/null --silent --head --fail -L https://{{ GLOBALS.manager_ip }}:9200
+  if [ $? -eq 0 ]; then
+    ELASTICSEARCH_CONNECTED="yes"
+    echo "connected!"
+    break
+  else
+    ((COUNT+=1))
+    sleep 1
+    echo -n "."
+  fi
+done
+if [ "$ELASTICSEARCH_CONNECTED" == "no" ]; then
+  echo
+  echo -e "Connection attempt timed out.  Unable to connect to ElasticSearch.  \nPlease try: \n  -checking log(s) in /var/log/elasticsearch/\n  -running 'docker ps' \n  -running 'sudo so-elastic-restart'"
+  echo
+
+  exit
+fi
+
+echo "Applying cross cluster search config..."
+    curl -K /opt/so/conf/elasticsearch/curl.config -s -k -XPUT -L https://{{ GLOBALS.manager_ip }}:9200/_cluster/settings \
+         -H 'Content-Type: application/json' \
+         -d "{\"persistent\": {\"search\": {\"remote\": {\"{{ grains.host }}\": {\"seeds\": [\"127.0.0.1:9300\"]}}}}}"

salt/utility/init.sls

@@ -0,0 +1,22 @@
+{% from 'allowed_states.map.jinja' import allowed_states %}
+{% from 'vars/globals.map.jinja' import GLOBALS %}
+
+{% if sls in allowed_states %}
+  {% if grains['role'] in ['so-eval', 'so-import'] %}
+fixsearch:
+  cmd.script:
+    - shell: /bin/bash
+    - cwd: /opt/so
+    - source: salt://utility/bin/eval
+    - template: jinja
+    - defaults:
+        GLOBALS: {{ GLOBALS }}
+  {% endif %}
+
+{% else %}
+
+{{sls}}_state_not_allowed:
+  test.fail_without_changes:
+    - name: {{sls}}_state_not_allowed
+
+{% endif %}

setup/so-functions

@@ -29,12 +29,8 @@ title() {
 }
 
 fail_setup() {
-	local err_msg=$1
-	if [[ -n "$err_msg" ]]; then
-		error "$err_msg"
-	fi
 	error "Setup encountered an unrecoverable failure, exiting"
-	echo "setup incomplete: $err_msg" > /root/failure
+	touch /root/failure
 	exit 1
 }
 
@@ -701,7 +697,7 @@ compare_main_nic_ip() {
 			EOM
 
 		  [[ -n $TESTING ]] || whiptail --title "$whiptail_title" --msgbox "$message" 11 75
-		  kill -SIGINT "$(ps --pid $$ -oppid=)"; fail_setup "Main IP mismatch"
+		  kill -SIGINT "$(ps --pid $$ -oppid=)"; fail_setup
 	  fi
 	else
 		# Setup uses MAINIP, but since we ignore the equality condition when using a VPN 
@@ -759,7 +755,8 @@ configure_management_bond() {
 	info "Setting up $bond_name management interface with mode $bond_mode"
 
 	if [[ ${#MBNICS[@]} -eq 0 ]]; then
-		fail_setup "No management bond NICs selected"
+		error "[ERROR] No management bond NICs were selected."
+		fail_setup
 	fi
 
 	nmcli -t -f NAME con show | grep -Fxq "$bond_name"
@@ -917,7 +914,8 @@ detect_os() {
 		is_rpm=true
 		is_supported=true
 	else
-		fail_setup "This OS is not supported. Security Onion requires Oracle Linux 9."
+		info "This OS is not supported. Security Onion requires Oracle Linux 9."
+		fail_setup
 	fi
 
 	info "Found OS: $OS $OSVER"
@@ -925,7 +923,7 @@ detect_os() {
 
 download_elastic_agent_artifacts() {
 	if ! update_elastic_agent 2>&1 | tee -a "$setup_log"; then
-		fail_setup "Failed to update Elastic Agent"
+		fail_setup
 	fi
 }
 
@@ -1569,7 +1567,7 @@ proxy_validate() {
 		error "Received error: $proxy_test_err"
 		if [[ -n $TESTING ]]; then
 			error "Exiting setup"
-			kill -SIGINT "$(ps --pid $$ -oppid=)"; fail_setup "Proxy validation failed"
+			kill -SIGINT "$(ps --pid $$ -oppid=)"; fail_setup
 		fi
 	fi
 	return $ret
@@ -1776,7 +1774,8 @@ ensure_pyyaml() {
 	local result=$?
 	set +o pipefail
 	if [[ $result -ne 0 ]] || ! rpm -q python3-pyyaml >/dev/null 2>&1; then
-		fail_setup "Failed to install python3-pyyaml (exit=$result)"
+		error "Failed to install python3-pyyaml (exit=$result)"
+		fail_setup
 	fi
 	info "python3-pyyaml installed successfully"
 }
@@ -1911,8 +1910,8 @@ repo_sync_local() {
 
 	if [[ ! $is_airgap ]]; then
 		curl --retry 5 --retry-delay 60 -A "netinstall/$SOVERSION/$OS/$(uname -r)/1" https://sigs.securityonion.net/checkup --output /tmp/install
-		retry 5 60 "dnf reposync --norepopath -g --delete -m -c /opt/so/conf/reposync/repodownload.conf --repoid=securityonionsync --download-metadata -p /nsm/repo/" >> "$setup_log" 2>&1 || fail_setup "Failed to sync repos"
+		retry 5 60 "dnf reposync --norepopath -g --delete -m -c /opt/so/conf/reposync/repodownload.conf --repoid=securityonionsync --download-metadata -p /nsm/repo/" >> "$setup_log" 2>&1 || fail_setup
-		retry 5 60 "dnf reposync --norepopath -g --delete -m -c /opt/so/conf/reposync/repodownload.conf --repoid=securityonionkernel --download-metadata -p /nsm/kernelrepo/" >> "$setup_log" 2>&1 || fail_setup "Failed to sync kernel repos"
+		retry 5 60 "dnf reposync --norepopath -g --delete -m -c /opt/so/conf/reposync/repodownload.conf --repoid=securityonionkernel --download-metadata -p /nsm/kernelrepo/" >> "$setup_log" 2>&1 || fail_setup
 		# After the download is complete run createrepo
 		create_repo
 	fi
@@ -1925,10 +1924,10 @@ saltify() {
 
 	if [[ $waitforstate ]]; then
 		# install all for a manager
-		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh -r -M -X stable $SALTVERSION" || fail_setup "Failed to install salt master"
+		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh -r -M -X stable $SALTVERSION" || fail_setup
 	else
 		# just a minion
-		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh -r -X stable $SALTVERSION" || fail_setup "Failed to install salt minion"
+		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh -r -X stable $SALTVERSION" || fail_setup
 	fi
 
 	salt_install_module_deps
@@ -2000,7 +1999,7 @@ set_main_ip() {
 			info "MAINIP=$MAINIP"
 			info "MNIC_IP=$MNIC_IP"
 			whiptail_error_message "The management IP could not be determined. Please check the log at /root/sosetup.log and verify the network configuration. Select OK to exit."
-			fail_setup "Could not determine MAINIP or MNIC_IP"
+			fail_setup
 		fi
 		sleep 1
 	done
@@ -2204,7 +2203,7 @@ set_initial_firewall_access() {
 set_management_interface() {
 	title "Setting up the main interface"
 	if [[ $MNIC == "bond1" ]]; then
-		configure_management_bond || fail_setup "Failed to configure management bond"
+		configure_management_bond || fail_setup
 	fi
 
 	if [ "$address_type" = 'DHCP' ]; then

setup/so-setup

@@ -9,17 +9,14 @@
 # Make sure you are root before doing anything
 uid="$(id -u)"
 if [ "$uid" -ne 0 ]; then
-	echo "This script must be run using sudo!" >&2
+	echo "This script must be run using sudo!"
-	exit 1
+	fail_setup
 fi
 
 # Save the original argument array since we modify it
 original_args=("$@")
 
-cd "$(dirname "$0")" || {
+cd "$(dirname "$0")" || fail_setup
-	echo "Unable to change to setup directory" >&2
-	exit 1
-}
 
 echo "Getting started..."
 
@@ -90,7 +87,8 @@ if [[ "$setup_type" == 'iso' ]]; then
 	if [[ $is_rpm ]]; then
 		is_iso=true
 	else
-		fail_setup "Only use 'so-setup iso' for an ISO install on Security Onion ISO images. Please run 'so-setup network' instead."
+		echo "Only use 'so-setup iso' for an ISO install on Security Onion ISO images. Please run 'so-setup network' instead."
+		fail_setup
 	fi
 fi
 
@@ -129,7 +127,7 @@ catch() {
 	info "Fatal error occurred at $1 in so-setup, failing setup."
 	grep --color=never "ERROR" "$setup_log" > "$error_log"
 	whiptail_setup_failed
-	fail_setup "Fatal error occurred at $1 in so-setup"
+	fail_setup
 }
 
 # Add the progress function for manager node type installs
@@ -237,7 +235,8 @@ case "$setup_type" in
 		info "Beginning Security Onion $setup_type install"
 		;;
 	*)
-		fail_setup "Invalid install type, must be 'iso', 'network' or 'desktop'."
+		error "Invalid install type, must be 'iso', 'network' or 'desktop'."
+		fail_setup
 		;;
 esac
 
@@ -771,7 +770,8 @@ if ! [[ -f $install_opt_file ]]; then
 		logCmd "salt-call state.apply -l info registry"
 		title "Seeding the docker registry"
 		if ! docker_seed_registry; then
-			fail_setup "Failed to seed the docker registry"
+			error "Failed to seed the docker registry"
+			fail_setup
 		fi
 		title "Applying the manager state"
 		logCmd "salt-call state.apply -l info manager"
@@ -794,7 +794,8 @@ if ! [[ -f $install_opt_file ]]; then
 		title "Setting up Elastic Fleet"
 		logCmd "salt-call state.apply elasticfleet.config"	
 		if ! logCmd so-elastic-fleet-setup; then
-			fail_setup "Failed to run so-elastic-fleet-setup"
+			error "Failed to run so-elastic-fleet-setup"
+			fail_setup
 		fi
 		mark_setup_complete
 		set_initial_firewall_access

setup/so-verify

@@ -143,15 +143,15 @@ main() {
         cat $error_log
         echo "--------------------------"
         exit_code=1
-        echo "Found setup errors. Check $error_log for details" > /root/failure
+        touch /root/failure
     elif using_iso && cron_error_in_mail_spool; then
         echo "WARNING: Unexpected cron job output in mail spool"
         exit_code=1
-        echo "Unexpected cron job output found in /var/spool/mail/" > /root/failure
+        touch /root/failure
     elif is_manager_node && status_failed; then
         echo "WARNING: Containers are not in a healthy state"
         exit_code=1
-        echo "Containers are not in a healthy state. Check so-status for details" > /root/failure
+        touch /root/failure
     else
         echo "Successfully completed setup!"
         touch /root/success