diff --git a/salt/filebeat/thirdpartydefaults.yml b/salt/filebeat/thirdpartydefaults.yml
new file mode 100644
index 000000000..9e5fef988
--- /dev/null
+++ b/salt/filebeat/thirdpartydefaults.yml
@@ -0,0 +1,17 @@
+thirtd_party_filebeat:
+  modules:
+    fortinet:
+      firewall:
+        enabled: false 
+        var.input: udp
+        var.syslog_host: 0.0.0.0
+        var.syslog_port: 9004
+      clientendpoint:
+        enabled: false
+        var.input: udp
+        var.syslog_host: 0.0.0.0
+        var.syslog_port: 9510
+      fortimail:
+        enabled: false
+        var.input: udp
+        var.syslog_port: 9350
\ No newline at end of file