From 3cff145e2dd86979d25d126937d0c17ab55394bc Mon Sep 17 00:00:00 2001
From: William Wernert <william.wernert@securityonionsolutions.com>
Date: Tue, 28 Apr 2020 16:18:48 -0400
Subject: [PATCH] [fix] Verify vm.max_map_count is present before so-thehive-es

---
 salt/hive/init.sls | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/salt/hive/init.sls b/salt/hive/init.sls
index 179ac5e1a..fd89fac09 100644
--- a/salt/hive/init.sls
+++ b/salt/hive/init.sls
@@ -55,6 +55,10 @@ hiveesdata:
     - user: 939
     - group: 939
 
+vm.max_map_count:
+  sysctl.present:
+    - value: 262144
+
 so-thehive-es:
   docker_container.running:
     - image: {{ MASTER }}:5000/soshybridhunter/so-thehive-es:{{ VERSION }}