diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index bb22849e5..a14c03e2d 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -75,7 +75,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.apm_server@package"
@@ -86,7 +86,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -109,7 +109,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.auditbeat@package"
@@ -120,7 +120,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -143,7 +143,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.cloudbeat@package"
@@ -154,7 +154,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -177,7 +177,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.endpoint_security@package"
@@ -188,7 +188,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -211,7 +211,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.filebeat@package"
@@ -222,7 +222,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -245,7 +245,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.fleet_server@package"
@@ -256,7 +256,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -279,7 +279,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.heartbeat@package"
@@ -290,7 +290,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -313,7 +313,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent@package"
@@ -324,7 +324,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -347,7 +347,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.metricbeat@package"
@@ -358,7 +358,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -381,7 +381,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.osquerybeat@package"
@@ -392,7 +392,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false
@@ -415,7 +415,7 @@ elasticsearch:
             _meta:
               package:
                 name: elastic_agent
-              managed_by: fleet
+              managed_by: security_onion
               managed: true
         composed_of:
           - "so-logs-elastic_agent.packetbeat@package"
@@ -426,7 +426,7 @@ elasticsearch:
         _meta:
           package:
             name: elastic_agent
-          managed_by: fleet
+          managed_by: security_onion
           managed: true
         data_stream:
           hidden: false