mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-10-23 22:53:03 +02:00
Josh Patterson
ff2b46b73e
pillar.get replaces lists, so once alerts queries are saved to pillar from the SOC config UI, queries added to defaults later (e.g. the licensed Group By Assessment, Name) never reach soc.json. Merge them by name the same way availableModels are merged by id: pillar order and edits are kept, and default queries missing from pillar are appended.