diff --git a/salt/zeek/defaults.yaml b/salt/zeek/defaults.yaml
index 64a332746..18e8a4d8a 100644
--- a/salt/zeek/defaults.yaml
+++ b/salt/zeek/defaults.yaml
@@ -37,6 +37,7 @@ zeek:
         - protocols/ftp/detect
         - protocols/conn/known-hosts
         - protocols/conn/known-services
+        - protocols/conn/vlan-logging
         - protocols/ssl/known-certs
         - protocols/ssl/validate-certs
         - protocols/ssl/log-hostcerts-only
@@ -44,7 +45,6 @@ zeek:
         - protocols/ssh/detect-bruteforcing
         - protocols/ssh/interesting-hostnames
         - protocols/http/detect-sqli
-	- protocols/conn/vlan-logging
         - frameworks/files/hash-all-files
         - frameworks/files/detect-MHR
         - policy/frameworks/notice/extend-email/hostnames