From 57d629683d8cd8b2391bc264d45b66802fb7d362 Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Mon, 27 Jul 2026 10:14:10 -0400
Subject: [PATCH] update vm state applid for pillar_push_map

---
 salt/reactor/pillar_push_map.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/reactor/pillar_push_map.yaml b/salt/reactor/pillar_push_map.yaml
index c77f5e93c..993444bd2 100644
--- a/salt/reactor/pillar_push_map.yaml
+++ b/salt/reactor/pillar_push_map.yaml
@@ -242,7 +242,7 @@ versionlock:
 # grain (compound supports nested grain matching via G@<key>:<subkey>:<value>).
 # pillar/vm/soc_vm.sls write path is referenced at salt/_runners/setup_hypervisor.py:856.
 vm:
-  - state: vm
+  - state: vm.user
     tgt: 'G@salt-cloud:driver:libvirt'
 
 # zeek: sensor_roles + so-import (5 roles).