clear stale docker network endpoints before starting containers

docker_container.running fails with an address-already-in-use error when a
container holds a stale sobridge endpoint - either after its IP changes in
pillar or after an unclean shutdown leaves the endpoint behind.

Add the clear_stale_endpoint macro and call it from every enabled.sls whose
container attaches to sobridge with a static IP. The macro force-disconnects
the container from the network only when its current endpoint IP does not
match the one salt is about to assign, so it is a no-op on a normal highstate.

The strelka states use state IDs that differ from their container names, so
those calls pass state_id explicitly. nginx resolves its IP through
container_config, which varies by role.

salt/docker/macros/docker_endpoint.jinja

@@ -0,0 +1,12 @@
+{% macro clear_stale_endpoint(container, network, ipv4, state_id=None) %}
+{{ container }}_{{ network }}_stale_endpoint:
+  cmd.run:
+    - name: docker network disconnect -f {{ network }} {{ container }} || true
+    - onlyif: docker inspect {{ container }}
+    - unless: >-
+        docker inspect -f
+        '{{ '{{' }} with index .NetworkSettings.Networks "{{ network }}" {{ '}}' }}{{ '{{' }} .IPAMConfig.IPv4Address {{ '}}' }}{{ '{{' }} end {{ '}}' }}'
+        {{ container }} 2>/dev/null | grep -qx '{{ ipv4 }}'
+    - require_in:
+      - docker_container: {{ state_id or container }}
+{% endmacro %}

salt/elastalert/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-elastalert', 'sobridge', DOCKERMERGED.containers['so-elastalert'].ip) }}
 
 include:
   - elastalert.config

salt/elastic-fleet-package-registry/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-elastic-fleet-package-registry', 'sobridge', DOCKERMERGED.containers['so-elastic-fleet-package-registry'].ip) }}
 
 include:
   - elastic-fleet-package-registry.config

salt/elasticagent/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-elastic-agent', 'sobridge', DOCKERMERGED.containers['so-elastic-agent'].ip) }}
 
 include:
   - ca

salt/elasticfleet/enabled.sls

@@ -8,6 +8,7 @@
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
 
 {#   This value is generated during node install and stored in minion pillar #}
 {%   set SERVICETOKEN = salt['pillar.get']('elasticfleet:config:server:es_token','') %}
@@ -43,6 +44,8 @@ elasticagent_syncartifacts:
 {% endif %}
 
 {%   if SERVICETOKEN != '' %}
+{{ clear_stale_endpoint('so-elastic-fleet', 'sobridge', DOCKERMERGED.containers['so-elastic-fleet'].ip) }}
+
 so-elastic-fleet:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent:{{ GLOBALS.so_version }}

salt/elasticsearch/enabled.sls

@@ -10,6 +10,9 @@
 {%   from 'elasticsearch/config.map.jinja' import ELASTICSEARCH_NODES %}
 {%   from 'elasticsearch/config.map.jinja' import ELASTICSEARCH_SEED_HOSTS %}
 {%   from 'elasticsearch/config.map.jinja' import ELASTICSEARCHMERGED %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-elasticsearch', 'sobridge', DOCKERMERGED.containers['so-elasticsearch'].ip) }}
 
 include:
   - ca

salt/hydra/enabled.sls

@@ -14,6 +14,9 @@
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   if 'api' in salt['pillar.get']('features', []) %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-hydra', 'sobridge', DOCKERMERGED.containers['so-hydra'].ip) }}
 
 include:
   - hydra.config

salt/influxdb/enabled.sls

@@ -9,6 +9,9 @@
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   set PASSWORD = salt['pillar.get']('secrets:influx_pass') %}
 {%   set TOKEN = salt['pillar.get']('influxdb:token') %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-influxdb', 'sobridge', DOCKERMERGED.containers['so-influxdb'].ip) }}
 
 include:
   - influxdb.ssl

salt/kafka/enabled.sls

@@ -16,6 +16,9 @@
 {%   set KAFKANODES = salt['pillar.get']('kafka:nodes') %}
 {%   set KAFKA_EXTERNAL_ACCESS = salt['pillar.get']('kafka:config:external_access:enabled', default=False) %}
 {%   if 'gmd' in salt['pillar.get']('features', []) %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-kafka', 'sobridge', DOCKERMERGED.containers['so-kafka'].ip) }}
 
 include:
   - kafka.ca

salt/kibana/enabled.sls

@@ -8,6 +8,9 @@
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'elasticsearch/config.map.jinja' import ELASTICSEARCHMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-kibana', 'sobridge', DOCKERMERGED.containers['so-kibana'].ip) }}
 
 include:
   - kibana.config

salt/kratos/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-kratos', 'sobridge', DOCKERMERGED.containers['so-kratos'].ip) }}
 
 include:
   - kratos.config

salt/logstash/enabled.sls

@@ -10,6 +10,9 @@
 {%   from 'logstash/map.jinja' import LOGSTASH_MERGED %}
 {%   from 'logstash/map.jinja' import LOGSTASH_NODES %}
 {%   set lsheap = LOGSTASH_MERGED.settings.lsheap %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-logstash', 'sobridge', DOCKERMERGED.containers['so-logstash'].ip) }}
 
 include:
   - ca

salt/nginx/enabled.sls

@@ -8,6 +8,7 @@
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'nginx/map.jinja' import NGINXMERGED %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
 
 include:
   - nginx.ssl
@@ -31,6 +32,8 @@ make-rule-dir-nginx:
 {%     set container_config = 'so-nginx-fleet-node' %}
 {%   endif %}
 
+{{ clear_stale_endpoint('so-nginx', 'sobridge', DOCKERMERGED.containers[container_config].ip) }}
+
 so-nginx:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-nginx:{{ GLOBALS.so_version }}

salt/postgres/enabled.sls

@@ -8,6 +8,9 @@
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   set SO_POSTGRES_USER = salt['pillar.get']('postgres:auth:users:so_postgres_user:user', 'so_postgres') %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-postgres', 'sobridge', DOCKERMERGED.containers['so-postgres'].ip) }}
 
 include:
   - postgres.auth

salt/redis/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-redis', 'sobridge', DOCKERMERGED.containers['so-redis'].ip) }}
 
 include:
   - ca

salt/registry/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-dockerregistry', 'sobridge', DOCKERMERGED.containers['so-dockerregistry'].ip) }}
 
 include:
   - registry.ssl

salt/soc/enabled.sls

@@ -10,6 +10,9 @@
 {%   from 'soc/merged.map.jinja' import DOCKER_EXTRA_HOSTS %}
 {%   from 'soc/merged.map.jinja' import SOCMERGED %}
 
+{% from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+{{ clear_stale_endpoint('so-soc', 'sobridge', DOCKERMERGED.containers['so-soc'].ip) }}
+
 include:
   - ca
   - soc.config

salt/soc/files/soc/playbook_placeholder_map.yaml

@@ -14,22 +14,18 @@
 
 CommandLine: process.command_line
 CurrentDirectory: process.working_directory
-Details: registry.data.strings
 Image: process.executable
-ImageLoaded: dll.path
+ImageLoaded: dll.name
 ParentImage: process.parent.executable
 ParentName: process.parent.name
 ParentProcessGuid: process.parent.entity_id
 ProcessGuid: process.entity_id
-TargetFilename: file.path
+TargetFilename: file.name
 TargetObject: registry.path
 TargetUserName: user.target.name
 User: user.name
 community_id: network.community_id
 dns_resolved_ip: dns.resolved_ip
-QueryName: dns.question.name
-dll_basename: dll.name
-file_basename: file.name
 document_id: soc_id
 dst_ip: destination.ip
 dst_port: destination.port
@@ -44,15 +40,10 @@ public_ip: network.public_ip
 related_hosts: related.hosts
 related_ip: related.ip
 src_ip: source.ip
-dns_query_name: dns.question.name
+dns_query_name: dns.query_name
 flow_id: log.id.uid
 payload: network.data.decoded
 rule_category: rule.category
 rule_name: rule.name
 rule_uuid: rule.uuid
 src_port: source.port
-# PowerShell channel (ps_script EID 4104 / classic EID 400)
-ScriptBlockText: powershell.file.script_block_text
-script_block_id: powershell.file.script_block_id
-script_block_hash: powershell.file.script_block_hash
-EngineVersion: powershell.engine.version

salt/soc/files/soc/sigma_playbook_pipeline.yaml

@@ -1,9 +1,8 @@
 name: Security Onion - Playbook Pipeline
 priority: 97
 transformations:
-    # Route to lowercase-normalized .caseless subfields for case-insensitive matching.
-    # file.path.caseless exists on Defend only (Sysmon file events lack it);
-    # registry.path / dll.path / file.name have no .caseless on any source.
+    # Route string fields to their lowercase-normalized .caseless subfield so wildcard
+    # matches are case-insensitive.
     - id: case_insensitive_string_fields
       type: field_name_mapping
       mapping:
@@ -11,121 +10,3 @@ transformations:
         process.parent.executable: process.parent.executable.caseless
         process.command_line: process.command_line.caseless
         process.parent.command_line: process.parent.command_line.caseless
-        file.path: file.path.caseless
-    # file_activity: playbook-only pseudo-category spanning all file operations.
-    - id: playbook_file_activity_add-fields
-      type: add_condition
-      conditions:
-        event.category: 'file'
-      rule_conditions:
-      - type: logsource
-        category: file_activity
-    # EventType -> event.action is safe as a projection only — the values differ
-    # (Sysmon DeleteFile/SetValue vs ECS deletion/modification).
-    - id: playbook_file_activity_event_type
-      type: field_name_mapping
-      mapping:
-        winlog.event_data.EventType: event.action
-      rule_conditions:
-      - type: logsource
-        category: file_activity
-    - id: playbook_file_event_event_type
-      type: field_name_mapping
-      mapping:
-        winlog.event_data.EventType: event.action
-      rule_conditions:
-      - type: logsource
-        category: file_event
-    - id: playbook_file_delete_event_type
-      type: field_name_mapping
-      mapping:
-        winlog.event_data.EventType: event.action
-      rule_conditions:
-      - type: logsource
-        category: file_delete
-    - id: playbook_file_rename_event_type
-      type: field_name_mapping
-      mapping:
-        winlog.event_data.EventType: event.action
-      rule_conditions:
-      - type: logsource
-        category: file_rename
-    - id: playbook_registry_set_event_type
-      type: field_name_mapping
-      mapping:
-        winlog.event_data.EventType: event.action
-      rule_conditions:
-      - type: logsource
-        category: registry_set
-    # WMI-Activity events carry no event.category; event.dataset is source-specific
-    - id: playbook_wmi_activity_add-fields
-      type: add_condition
-      conditions:
-        event.dataset: 'wmi.operational'
-      rule_conditions:
-      - type: logsource
-        category: wmi
-    - id: playbook_wmi_event_activity_add-fields
-      type: add_condition
-      conditions:
-        event.dataset: 'wmi.operational'
-      rule_conditions:
-      - type: logsource
-        category: wmi_event
-    - id: playbook_ps_script_field-mapping
-      type: field_name_mapping
-      mapping:
-        ScriptBlockText: powershell.file.script_block_text
-        Path: file.path
-      rule_conditions:
-      - type: logsource
-        category: ps_script
-    - id: playbook_ps_script_add-fields
-      type: add_condition
-      conditions:
-        event.dataset: 'windows.powershell_operational'
-        event.code: '4104'
-      rule_conditions:
-      - type: logsource
-        category: ps_script
-    # Data (raw EID 400/600 message blob) -> process.command_line: the winlog
-    # integration parses HostApplication into it; `message` is analyzed text and
-    # wildcard matches on it silently return zero. No .caseless on this dataset.
-    - id: playbook_ps_classic_start_field-mapping
-      type: field_name_mapping
-      mapping:
-        Data: process.command_line
-      rule_conditions:
-      - type: logsource
-        category: ps_classic_start
-    - id: playbook_ps_classic_start_add-fields
-      type: add_condition
-      conditions:
-        event.dataset: 'windows.powershell'
-        event.code: '400'
-      rule_conditions:
-      - type: logsource
-        category: ps_classic_start
-    - id: playbook_ps_classic_provider_start_field-mapping
-      type: field_name_mapping
-      mapping:
-        Data: process.command_line
-      rule_conditions:
-      - type: logsource
-        category: ps_classic_provider_start
-    - id: playbook_ps_classic_provider_start_add-fields
-      type: add_condition
-      conditions:
-        event.dataset: 'windows.powershell'
-        event.code: '600'
-      rule_conditions:
-      - type: logsource
-        category: ps_classic_provider_start
-    # Alert docs nest the host under event_data.host.name; no top-level host.name.
-    - id: playbook_alert_host_field
-      type: field_name_mapping
-      mapping:
-        host.name: event_data.host.name
-      rule_conditions:
-      - type: logsource
-        category: alert

salt/soc/files/soc/sigma_so_pipeline.yaml

@@ -131,22 +131,13 @@ transformations:
       type: field_name_mapping
       mapping:
         winlog.event_data.Details: registry.data.strings
+        # field rename only; EventType values (SetValue/CreateKey) still differ from
+        # event.action values (modification/creation)
+        winlog.event_data.EventType: event.action
       rule_conditions:
       - type: logsource
         product: windows
         category: registry_set
-    # ecs_windows renames Initiated -> network.direction without translating the value,
-    # so rules compile to network.direction:"true" and never match (field holds
-    # ingress/egress). network.initiated carries the boolean on both Defend and Sysmon.
-    # Keyed on network.direction because ecs_windows has already renamed by this layer.
-    - id: ecs_fix_network_connection_initiated
-      type: field_name_mapping
-      mapping:
-        network.direction: network.initiated
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: network_connection
     - id: ecs_fix_image_load
       type: field_name_mapping
       mapping:
@@ -159,30 +150,6 @@ transformations:
       - type: logsource
         product: windows
         category: image_load
-    # Defend reports the driver image in dll.path (file.path is null on driver events) —
-    # same renames as image_load.
-    - id: ecs_fix_driver_load
-      type: field_name_mapping
-      mapping:
-        file.path: dll.path
-        file.code_signature.signed: dll.code_signature.exists
-        winlog.event_data.Signature: dll.code_signature.subject_name
-        file.code_signature.status: dll.code_signature.status
-        winlog.event_data.Hashes: dll.hash.sha256
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: driver_load
-    - id: ecs_fix_file_rename
-      type: field_name_mapping
-      mapping:
-        # Defend records the pre-rename path in file.Ext.original.path; Sysmon's
-        # SourceFilename has no ECS equivalent.
-        winlog.event_data.SourceFilename: file.Ext.original.path
-      rule_conditions:
-      - type: logsource
-        product: windows
-        category: file_rename
     - id: linux_security_add-fields
       type: add_condition
       conditions:
@@ -356,33 +323,6 @@ transformations:
       rule_conditions:
       - type: logsource
         category: file_event
-    # Without event.type scoping, file_delete rules also match creations.
-    - id: endpoint_file_delete_add-fields
-      type: add_condition
-      conditions:
-        event.category: 'file'
-        event.type: 'deletion'
-      rule_conditions:
-      - type: logsource
-        category: file_delete
-    # Defend reports renames as event.action:rename with event.type:change.
-    - id: endpoint_file_rename_add-fields
-      type: add_condition
-      conditions:
-        event.category: 'file'
-        event.action: 'rename'
-      rule_conditions:
-      - type: logsource
-        category: file_rename
-    # event.type:change selects writes and excludes Defend's read-only registry events.
-    - id: endpoint_registry_set_add-fields
-      type: add_condition
-      conditions:
-        event.category: 'registry'
-        event.type: 'change'
-      rule_conditions:
-      - type: logsource
-        category: registry_set
     # Scope image_load rules to Elastic Endpoint library events (event.category:library, dll.*
     # populated).
     - id: endpoint_image_load_add-fields
@@ -411,149 +351,6 @@ transformations:
       rule_conditions:
       - type: logsource
         category: network_connection
-    # Scope on lookup actions, not network.protocol:dns (also matches Zeek port-53).
-    - id: endpoint_dns_query_add-fields
-      type: add_condition
-      conditions:
-        event.category: 'network'
-        event.action:
-          - 'lookup_requested'
-          - 'lookup_result'
-      rule_conditions:
-      - type: logsource
-        category: dns_query
-    # OS gates: without them a `product: windows` rule in these categories also matches
-    # Linux/macOS. Separate conditions (not `product:` on the mappings above) so the
-    # mappings keep scoping product-less rules.
-    - id: endpoint_file_create_windows_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'windows'
-      rule_conditions:
-      - type: logsource
-        category: file_event
-        product: windows
-    - id: endpoint_file_create_linux_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'linux'
-      rule_conditions:
-      - type: logsource
-        category: file_event
-        product: linux
-    - id: endpoint_file_create_macos_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'macos'
-      rule_conditions:
-      - type: logsource
-        category: file_event
-        product: macos
-    - id: endpoint_file_delete_windows_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'windows'
-      rule_conditions:
-      - type: logsource
-        category: file_delete
-        product: windows
-    - id: endpoint_file_delete_linux_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'linux'
-      rule_conditions:
-      - type: logsource
-        category: file_delete
-        product: linux
-    - id: endpoint_file_delete_macos_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'macos'
-      rule_conditions:
-      - type: logsource
-        category: file_delete
-        product: macos
-    - id: endpoint_file_rename_windows_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'windows'
-      rule_conditions:
-      - type: logsource
-        category: file_rename
-        product: windows
-    - id: endpoint_file_rename_linux_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'linux'
-      rule_conditions:
-      - type: logsource
-        category: file_rename
-        product: linux
-    - id: endpoint_file_rename_macos_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'macos'
-      rule_conditions:
-      - type: logsource
-        category: file_rename
-        product: macos
-    - id: endpoint_network_connection_windows_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'windows'
-      rule_conditions:
-      - type: logsource
-        category: network_connection
-        product: windows
-    - id: endpoint_network_connection_linux_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'linux'
-      rule_conditions:
-      - type: logsource
-        category: network_connection
-        product: linux
-    - id: endpoint_network_connection_macos_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'macos'
-      rule_conditions:
-      - type: logsource
-        category: network_connection
-        product: macos
-    - id: endpoint_dns_query_windows_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'windows'
-      rule_conditions:
-      - type: logsource
-        category: dns_query
-        product: windows
-    - id: endpoint_dns_query_linux_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'linux'
-      rule_conditions:
-      - type: logsource
-        category: dns_query
-        product: linux
-    - id: endpoint_dns_query_macos_os-gate
-      type: add_condition
-      conditions:
-        host.os.type: 'macos'
-      rule_conditions:
-      - type: logsource
-        category: dns_query
-        product: macos
-    # registry_set / image_load / driver_load are not gated — windows-only telemetry.
-    # wmi / wmi_event are not scoped here: their only handle is event.dataset
-    - id: endpoint_driver_load_add-fields
-      type: add_condition
-      conditions:
-        event.category: 'driver'
-      rule_conditions:
-      - type: logsource
-        category: driver_load
     # Maps "alert" category to SO Alert events
     - id: alert_so_add-fields
       type: add_condition

salt/strelka/backend/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-strelka-backend', 'sobridge', DOCKERMERGED.containers['so-strelka-backend'].ip, state_id='strelka_backend') }}
 
 include:
   - strelka.backend.config

salt/strelka/coordinator/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-strelka-coordinator', 'sobridge', DOCKERMERGED.containers['so-strelka-coordinator'].ip, state_id='strelka_coordinator') }}
 
 include:
   - strelka.coordinator.config

salt/strelka/filestream/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-strelka-filestream', 'sobridge', DOCKERMERGED.containers['so-strelka-filestream'].ip, state_id='strelka_filestream') }}
 
 include:
   - strelka.filestream.config

salt/strelka/frontend/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-strelka-frontend', 'sobridge', DOCKERMERGED.containers['so-strelka-frontend'].ip, state_id='strelka_frontend') }}
 
 include:
   - strelka.frontend.config

salt/strelka/gatekeeper/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-strelka-gatekeeper', 'sobridge', DOCKERMERGED.containers['so-strelka-gatekeeper'].ip, state_id='strelka_gatekeeper') }}
 
 include:
   - strelka.gatekeeper.config

salt/strelka/manager/enabled.sls

@@ -7,6 +7,9 @@
 {% if sls.split('.')[0] in allowed_states %}
 {%   from 'docker/docker.map.jinja' import DOCKERMERGED %}
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
+{%   from 'docker/macros/docker_endpoint.jinja' import clear_stale_endpoint %}
+
+{{ clear_stale_endpoint('so-strelka-manager', 'sobridge', DOCKERMERGED.containers['so-strelka-manager'].ip, state_id='strelka_manager') }}
 
 include:
   - strelka.manager.config