diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja index 0c97f93bd..4673f1915 100644 --- a/salt/soc/merged.map.jinja +++ b/salt/soc/merged.map.jinja @@ -85,7 +85,7 @@ {% do SOCMERGED.config.server.update({'airgapEnabled': false}) %} {% endif %} -{# Sigma correlations require ES|QL: offer correlation authoring only when it is on #} +{# correlation authoring requires ES|QL #} {% if not SOCMERGED.config.server.modules.elastalertengine.useEsql %} {% do SOCMERGED.config.server.client.detection.templateDetections.pop('elastalert_correlation', None) %} {% do SOCMERGED.config.server.client.detections.update({'queries': SOCMERGED.config.server.client.detections.queries | rejectattr('name', 'equalto', 'Detection Type - Sigma (Elastalert) - Correlations') | list}) %}