Merge pull request #16312 from Security-Onion-Solutions/mwright/md-img-toggle

Add allowExternalMarkdownImages SOC Setting
turn off advanced
2026-10-08 23:35:37 +02:00 · 2026-10-08 12:38:45 -04:00 · 2026-10-08 12:38:13 -04:00 · 2026-10-08 12:10:30 -04:00 · 2026-10-08 10:13:30 -05:00 · 2026-10-08 09:54:41 -05:00
7 changed files with 29 additions and 18 deletions
@@ -178,6 +178,7 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Missing ory_kratos_session cookie" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Static assets preprocessor only supports GET and HEAD requests" # expected WARN log lines indicating invalid auth header
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|respondError"                 # respondError is a function name, output via http middleware as standard request logging
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|GET /kibana/"                 # Ignore Kibana queries with triggered words
 fi
 if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
@@ -1,7 +1,7 @@
 elasticsearch:
  enabled: false
  esheap: '600m'
-  version: 9.4.5
+  version: 9.4.8
  index_clean: true
  data_retention_method: DLM
  vm:
@@ -22,7 +22,7 @@ kibana:
          - default
          - file
    migrations:
-      discardCorruptObjects: "9.4.5"
+      discardCorruptObjects: "9.4.8"
    telemetry:
      enabled: False
    xpack:
@@ -1131,9 +1131,6 @@ post_to_3.2.0() {
 ### 3.3.0 Scripts ###
 up_to_3.3.0() {
  # download 9.4.5 elastic agent packages
  determine_elastic_agent_upgrade
  # remove existing (patched) elasticsearch index template to match integration naming change
  if ! remove_elasticsearch_index_template "so-logs-sentinel_one_cloud_funnel.login" "sentinel_one_cloud_funnel.login changed to sentinel_one_cloud_funnel.logins"; then
    FINAL_MESSAGE_QUEUE+=("WARNING: Unable to automatically remove the so-logs-sentinel_one_cloud_funnel.login index template. This step can be performed manually using the following command:")
@@ -1165,11 +1162,7 @@ telegraf_repair() {
 post_to_3.3.0() {
  # Recollate again since some internal DBs were excluded during 3.2.0 soup
  recollate_postgres
-
+  
  # Generate 9.4.5 elastic agent installers
  echo "Regenerating Elastic Agent Installers"
  /sbin/so-elastic-agent-gen-installers
  telegraf_repair
  set_postversion 3.3.0
@@ -1178,6 +1171,9 @@ post_to_3.3.0() {
 ### 3.4.0 Scripts ###
 up_to_3.4.0() {
  # download 9.4.8 elastic agent packages
  determine_elastic_agent_upgrade
  set_soauth_range
  echo "Removing so-kratos, so-hydra and so-soc so they are recreated on the soauth network."
@@ -1255,6 +1251,10 @@ valid_soauth_range() {
 }
 post_to_3.4.0() {
  # Generate 9.4.8 elastic agent installers
  echo "Regenerating Elastic Agent Installers"
  /sbin/so-elastic-agent-gen-installers
  for idx in "metrics-logstash.node-default" "metrics-logstash.stack_monitoring.node-default"; do
    rollover_index "$idx"
  done
@@ -1535,9 +1535,10 @@ verify_es_version_compatibility() {
      ["8.18.4"]="8.18.6 8.18.8 9.0.8"
 	    ["8.18.6"]="8.18.8 9.0.8"
 	    ["8.18.8"]="9.0.8"
-      ["9.0.8"]="9.3.3 9.3.7 9.4.5"
+      ["9.0.8"]="9.3.3 9.3.7 9.4.5 9.4.8"
-      ["9.3.3"]="9.3.7 9.4.5"
+      ["9.3.3"]="9.3.7 9.4.5 9.4.8"
-      ["9.3.7"]="9.4.5"
+      ["9.3.7"]="9.4.5 9.4.8"
      ["9.4.5"]="9.4.8"
    )
    # Elasticsearch MUST upgrade through these versions
@@ -1821,6 +1821,7 @@ soc:
        cacheExpirationMs: 300000
        casesEnabled: true
        detectionsEnabled: true
        allowExternalMarkdownImages: false
        inactiveTools: ['toolUnused']
        exportNodeId:
        tools:
@@ -513,6 +513,10 @@ soc:
            description: Enables or disables the SOC notification module.
            forcedType: bool
            global: True
          connectionTimeoutSeconds:
            description: Duration (in seconds) to wait for a response from the remote notification endpoint host before giving up.
            forcedType: int
            global: True
        postgres:
          host:
            description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.
@@ -1025,7 +1029,7 @@ soc:
            forcedType: int
          automationSettings:
            tickIntervalSeconds:
-              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0.
+              description: How often, in seconds, the automation scheduler checks for automations that are due to run. Must be greater than 0. This value is also the default interval for new automations, however admins can override individual automation intervals to a longer value via the Agent Studio.
              global: True
              advanced: True
              forcedType: int
@@ -1151,6 +1155,10 @@ soc:
          description: Set to true to enable the Detections module in SOC.
          global: True
          forcedType: bool
        allowExternalMarkdownImages:
          description: Set to true to let user-written Markdown, such as case descriptions and comments, load images from other servers. Loading an image sends a request to its server, so leave this disabled unless needed; Onion AI output never loads external images.
          global: True
          forcedType: bool
        inactiveTools:
          description: List of external tools to remove from the SOC UI.
          global: True
@@ -1333,8 +1333,8 @@ DISA STIG for Oracle Linux 9 V1R3.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="false"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>
@@ -1935,8 +1935,8 @@ standard DISA STIG for Oracle Linux 9 profile.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="false"/>
-        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
+        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>
Author	SHA1	Message	Date
Matthew Wright	603949002b	Merge pull request #16312 from Security-Onion-Solutions/mwright/md-img-toggle Add allowExternalMarkdownImages SOC Setting	2026-10-08 12:38:45 -04:00
Matthew Wright	de63f95ab0	turn off advanced	2026-10-08 12:38:13 -04:00
Matthew Wright	a1b76650fb	add external image markdown toggle	2026-10-08 12:10:30 -04:00
Jorge Reyes	0cd8e53832	Merge pull request #16311 from Security-Onion-Solutions/reyesj2-patch-4 regenerate elastic agent installer	2026-10-08 10:13:30 -05:00
reyesj2	0210ccfcc3	elastic agent 9.4.8 regenerate installer	2026-10-08 09:54:41 -05:00
reyesj2	517076330a	stg profile update - breaks so-elastic-agent / so-elastic-fleet containers	2026-10-08 09:54:35 -05:00
Jason Ertel	ad249782fc	Merge pull request #16310 from Security-Onion-Solutions/jertel/wip new destination timeout annotation; fix fp	2026-10-08 10:48:26 -04:00
Jason Ertel	2eab084358	new destination timeout annotation; fix fp	2026-10-08 10:46:15 -04:00
Jorge Reyes	547d2a316b	Merge pull request #16306 from Security-Onion-Solutions/reyesj2/es948 ES 9.4.8	2026-10-07 16:17:52 -05:00
Jorge Reyes	1c4eef4224	Update version from 3.0.0-foxtrot to 3.4.0	2026-10-07 12:31:45 -05:00
Jason Ertel	d1114a0dae	Merge pull request #16300 from Security-Onion-Solutions/jertel/wip update tick interval desc	2026-10-06 18:41:48 -04:00
Jason Ertel	f4b301d71c	update tick interval desc	2026-10-06 18:32:49 -04:00
Jorge Reyes	c6e42131b2	Update version from 3.4.0 to 3.0.0-foxtrot	2026-10-06 13:45:22 -05:00
reyesj2	337dddf596	ES 9.4.8	2026-10-06 13:44:52 -05:00
Josh Patterson	f7dbfba178	Merge pull request #16297 from Security-Onion-Solutions/revert-16274-fix/auto-apply-state-queue Revert "Fix/auto apply state queue"	2026-10-05 17:54:16 -04:00
Josh Patterson	0a628bb7e7	Revert "Fix/auto apply state queue"	2026-10-05 17:43:08 -04:00
Josh Patterson	bd6647e775	Merge pull request #16274 from Security-Onion-Solutions/fix/auto-apply-state-queue Fix/auto apply state queue	2026-10-05 14:33:02 -04:00
Josh Brower	da2c19188a	Merge pull request #16287 from Security-Onion-Solutions/sigma-pipeline-dir Move Sigma pipelines into a managed directory	2026-10-05 09:41:48 -04:00
Josh Patterson	ba95b9bbc2	Address review feedback on so-push-drainer result tracking Result checks walked dispatch records oldest-first with a cap of five lookups per pass, counting records whose push was still running. Five long-running pushes therefore used every slot on every 15s pass and newer, finished pushes were not reported until one cleared. Check the least recently checked records first and back off on pushes that are still running (30s for the first two minutes, then age/4 up to 5 minutes), recording checked_at in the dispatch record. Catch any exception when writing a dispatch record so a failed write cannot skip intent cleanup and re-dispatch the same intents every pass. Log both output streams when no jid is found, and stop logging a traceback when a record has already been removed. Scope the test's salt mock to the drainer import. Run from the repo root, 'salt' resolves to this repo's salt/ directory as a namespace package, so setdefault left it in place and test_load_push_cfg failed. Verified on a 3.4.0 managersearch + sensor: a pushed highstate with soc and telegraf pushes dispatched into it all reported success, with 25 result lookups across the three pushes instead of one per record per pass.	2026-10-02 10:35:30 -04:00
Josh Patterson	8de8ba811a	Harden so-push-drainer result parsing _orch_failures assumed every level of a jobs.lookup_jid result was a dict. A list or string at the top level, in return.data, in a step's changes, or in changes.ret raised AttributeError. Because result checks run before the drain and a record is only removed after it is evaluated, one such record would have failed every 15s pass and stopped all pushes until it was removed by hand. Guard each shape, and evaluate each record under its own exception handler so an unreadable result is logged and dropped instead of blocking the drainer. Per-step parsing moves to _step_failures. Search stdout as well as stderr for the async jid, in case salt-run logging is routed to stdout. Close the RotatingFileHandler in test_make_logger_adds_handler_once to avoid a ResourceWarning on Python 3.12+. Verified on a 3.4.0 standalone: real failed and successful orchestration results parse as before, a record whose evaluation raises is logged and removed while the next record still reports, and a replicated SOC change to telegraf.output (and its revert) is pushed, rendered and logged as succeeded.	2026-10-01 09:06:28 -04:00
Josh Patterson	9732e1c639	Trim tracebacks in push failure log lines When an orchestration step raises, salt returns the full traceback as the step comment, and the drainer wrote it verbatim, putting ~70 lines into so-push-drainer.log per failure. Collapse comments to one line and, for tracebacks, keep only the lead-in and the raised exception, e.g. "apply_soc_1: An exception occurred in this state: salt.exceptions.AuthenticationError: Authentication error occurred." Seen on a standalone when a pushed highstate restarted salt-master while two queued pushes were waiting: their orchestrations lost the master connection and failed with AuthenticationError, although the minion completed both state runs.	2026-09-30 16:18:37 -04:00
Josh Patterson	53f9ebcd46	FIX: queue auto-applied state runs instead of failing on conflict orch.push_batch passed `kwarg: {queue: 2}` to salt.state, but in Salt 3006 queue is a top-level salt.state argument and salt.state always sets the minion's queue kwarg from it (default False), so the kwarg block was silently dropped and every pushed state ran with queue=False. The drainer dispatches a separate async orchestration each 15s pass, so settings saved more than ~15s apart overlap on the same minion and every run after the first fails immediately with 'The function "state.sls" is running as PID ...'. The change then waits for the next scheduled highstate. Seen on a 3.4.0 standalone: hydra.enabled, telegraf.output, and two soc settings (including soc.config.licenseKey) were saved within 30s. The soc state was dispatched while the telegraf state was still running and was rejected, so the license key was not applied. Use `queue: True`, as orch.deploy_newnode already does. An int is treated as max_queue and still falls through to the conflict error once that many state runs are active. The failure was only visible in the master log, since the drainer dispatches with --async and logged only "dispatch accepted". The drainer now: - logs each dispatched action - parses the orchestration jid from salt-run's stderr (the only place --async reports it) and records it under /opt/so/state/push_dispatched - on later passes looks each jid up with jobs.lookup_jid and logs either "push succeeded" or an ERROR with the failed step, the per-minion failed states or rejection text, and the triggering paths Lookups run outside the pending-intent lock since the reactors share it. The beacon now logs each audit_settings row it emits and the reactor logs the audit row id, so a single change can be traced from audit_settings to its push result. Adds so-push-drainer_test.py; the drainer is now held to the 100% coverage requirement in python-test. Verified on the standalone: a soc push dispatched while a 90s state run was in progress queued behind it (queue=True in the job args), completed, and the drainer logged "push succeeded" for its jid. The new result parsing reports the original soc conflict and the hydra license failure from the job cache.	2026-09-30 16:18:37 -04:00