diff --git a/salt/suricata/config.sls b/salt/suricata/config.sls
index b6796031f..e0b85b7e7 100644
--- a/salt/suricata/config.sls
+++ b/salt/suricata/config.sls
@@ -160,7 +160,6 @@ surithresholding:
     - source: salt://suricata/files/threshold.conf
     - user: 940
     - group: 940
-    - onlyif: salt://suricata/files/threshold.conf
 
 suriclassifications:
   file.managed:
diff --git a/salt/suricata/files/threshold.conf b/salt/suricata/files/threshold.conf
new file mode 100644
index 000000000..a03ac31a3
--- /dev/null
+++ b/salt/suricata/files/threshold.conf
@@ -0,0 +1,2 @@
+# Threshold configuration generated by Security Onion
+# This file is automatically generated - do not edit manually
\ No newline at end of file