[SOC-AI] Anthropic provider dropdown lists invalid / retired Claude model IDs

[JocLRojas]

Acknowledgements

• I have searched (https://github.com/utmstack/UTMStack/issues) for past instances of this issue
• I have verified that my UTMStack version is up-to-date

Describe the bug

The Anthropic provider selector in the SOC-AI integration guide offers three predefined model IDs that are no longer available in the Anthropic public API. Any alert parsed with the default selection fails in the Anthropic messaging API with a 4xx error, and the user interface displays the message "The SOC-AI integration could not analyze this alert due to a processing error. Please try again."

Current dropdown value	Real status at Anthropic
claude-sonnet-4-20250514	Retired on 2026-06-15 (deprecated 2026-04-14). Requests fail.
claude-opus-4-20250514	Retired on 2026-06-15 (deprecated 2026-04-14). Requests fail.
claude-haiku-4-20250414	Not in current models, legacy list, or deprecations.

Sonnet and Opus worked until Anthropic retired those snapshots on 2026-06-15

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

The Anthropic provider dropdown should list only model IDs that are currently active in the Anthropic Messages API. Selecting any option from the dropdown, saving the configuration, and running an analysis on an alert should successfully return a classification from Claude, with no "processing error" shown in the UI.

Ideally the dropdown should use Anthropic's stable, dateless API aliases (e.g. claude-opus-4-8, claude-sonnet-5, claude-haiku-4-5) so that this class of bug does not recur silently when Anthropic retires the underlying snapshot. Aliases keep resolving to a supported model when the snapshot changes; dated IDs do not.

Suggested new options for the Anthropic block:

options: [
  {value: 'claude-opus-4-8',   label: 'claude-opus-4-8 (most capable)'},
  {value: 'claude-sonnet-5',   label: 'claude-sonnet-5 (balanced)'},
  {value: 'claude-haiku-4-5',  label: 'claude-haiku-4-5 (fastest)'},
  {value: 'claude-opus-4-7',   label: 'claude-opus-4-7 (legacy)'},
  {value: 'claude-opus-4-6',   label: 'claude-opus-4-6 (legacy)'},
  {value: 'claude-sonnet-4-6', label: 'claude-sonnet-4-6 (legacy)'},
  {value: '__custom__',        label: 'Custom model...'},
]

The exact list can be adjusted — the requirement is that every hardcoded value must be a currently active API alias or model ID listed at https://docs.claude.com/en/docs/about-claude/models/overview at the time of the fix. The Custom model... option must remain available for operators who need to pin a specific dated snapshot.

Optional UI improvement: update the Anthropic provider description in the same file to point operators to Anthropic's model overview page, so they know they can pick Custom model... if they need something newer than the hardcoded list.

Current Behavior

When an operator selects any of the three preloaded Anthropic models and triggers an alert analysis, the SOC-AI plugin sends a POST to https://api.anthropic.com/v1/messages with an invalid model ID.

The SOC-AI plugin retries three times, then marks the alert as failed in the v11-soc-ai OpenSearch index (status: Error).

The SOC-AI panel in the alert-management UI then renders the generic error block:

"Error! The SOC-AI integration could not analyze this alert due to a processing error. Please try again."

Reproduction Steps

1. Deploy or run any UTMStack build that includes the current SOC-AI multi-provider guide (introduced in PR Release/v11.2.6 #2025).
2. Log in as an admin and open Integrations → SOC-AI configuration guide.
3. Select the Anthropic provider tab.
4. Enter a valid Anthropic API key (from https://console.anthropic.com/settings/keys).
5. In the Model dropdown, pick any of the three preloaded options:
   • claude-sonnet-4-20250514
   • claude-haiku-4-20250414
   • claude-opus-4-20250514
6. Set Max Tokens to 4096 (or any positive value), save the configuration, and enable auto-analyze (or leave manual).
7. Go to Alerts, open any alert, and either wait for auto-analysis or click "Analyze with SOC AI".
8. Observe the SOC-AI panel for that alert.

Observed result: The panel shows the red error block:
"Error! The SOC-AI integration could not analyze this alert due to a processing error. Please try again."

Expected result: The panel should show a Claude-produced classification, reasoning, and next steps.

Workaround (until the fix lands): in the same dropdown, choose Custom model... and manually enter a currently active Anthropic model ID such as claude-opus-4-8, claude-sonnet-5, or claude-haiku-4-5.

Possible Solution

No response

Additional Information/Context

No response

UTMStack Version

v11.2.12

Operating System and version

Ubuntu 24

Hypervisor and Version | Server Vendor and Model

dev-env

Browser and version

Chrome