From 308041fad61cb88bee8b286ccb8ca1f031a1b3b5 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Tue, 1 Oct 2019 17:59:35 -0400
Subject: [PATCH] SOCtopus - Edit osquery playbook template

Fixes bug for when there is no [osquery][columns][address] field
---
 salt/soctopus/files/templates/osquery.template | 1 -
 1 file changed, 1 deletion(-)

diff --git a/salt/soctopus/files/templates/osquery.template b/salt/soctopus/files/templates/osquery.template
index 23b3ad1af..1e85a3182 100644
--- a/salt/soctopus/files/templates/osquery.template
+++ b/salt/soctopus/files/templates/osquery.template
@@ -45,4 +45,3 @@ hive_observable_data_mapping:
   - ip: '{match[osquery][EndpointIP2]}'
   - other: '{match[osquery][hostIdentifier]}'
   - other: '{match[osquery][hostname]}'
-  - ip: '{match[osquery][columns][address]}'