From 06ffaf1373b35a757aea090052e6f8e063d6e74c Mon Sep 17 00:00:00 2001
From: defensivedepth <josh@defensivedepth.com>
Date: Tue, 6 Oct 2026 06:49:27 -0400
Subject: [PATCH] Cleanup

---
 salt/soc/merged.map.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
index 0c97f93bd..4673f1915 100644
--- a/salt/soc/merged.map.jinja
+++ b/salt/soc/merged.map.jinja
@@ -85,7 +85,7 @@
 {%   do SOCMERGED.config.server.update({'airgapEnabled': false}) %}
 {% endif %}
 
-{# Sigma correlations require ES|QL: offer correlation authoring only when it is on #}
+{# correlation authoring requires ES|QL #}
 {% if not SOCMERGED.config.server.modules.elastalertengine.useEsql %}
 {%   do SOCMERGED.config.server.client.detection.templateDetections.pop('elastalert_correlation', None) %}
 {%   do SOCMERGED.config.server.client.detections.update({'queries': SOCMERGED.config.server.client.detections.queries | rejectattr('name', 'equalto', 'Detection Type - Sigma (Elastalert) - Correlations') | list}) %}