From 3f9a9b7019bd1fb456d9c39efdbc16652214253c Mon Sep 17 00:00:00 2001
From: DefensiveDepth <josh@defensivedepth.com>
Date: Fri, 5 Dec 2025 10:23:24 -0500
Subject: [PATCH] tweak threshold

---
 salt/suricata/config.sls           | 1 -
 salt/suricata/files/threshold.conf | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 salt/suricata/files/threshold.conf

diff --git a/salt/suricata/config.sls b/salt/suricata/config.sls
index b6796031f..e0b85b7e7 100644
--- a/salt/suricata/config.sls
+++ b/salt/suricata/config.sls
@@ -160,7 +160,6 @@ surithresholding:
     - source: salt://suricata/files/threshold.conf
     - user: 940
     - group: 940
-    - onlyif: salt://suricata/files/threshold.conf
 
 suriclassifications:
   file.managed:
diff --git a/salt/suricata/files/threshold.conf b/salt/suricata/files/threshold.conf
new file mode 100644
index 000000000..a03ac31a3
--- /dev/null
+++ b/salt/suricata/files/threshold.conf
@@ -0,0 +1,2 @@
+# Threshold configuration generated by Security Onion
+# This file is automatically generated - do not edit manually
\ No newline at end of file