diff --git a/salt/salt/master/refresh_fileserver.sls b/salt/salt/master/refresh_fileserver.sls
new file mode 100644
index 000000000..6b5640796
--- /dev/null
+++ b/salt/salt/master/refresh_fileserver.sls
@@ -0,0 +1,3 @@
+refresh_salt_master_fileserver:
+ saltmod.runner:
+   - name: fileserver.update
\ No newline at end of file
diff --git a/salt/suricata/init.sls b/salt/suricata/init.sls
index ddd127f54..0f3d49bc3 100644
--- a/salt/suricata/init.sls
+++ b/salt/suricata/init.sls
@@ -55,18 +55,6 @@ surilogdir:
     - user: 940
     - group: 939
 
-surilocaldir:
-  file.directory:
-    - name: /opt/so/saltstack/local/salt/suricata
-    - user: 940
-    - group: 940
-    - makedirs: True
-
-ruleslink:
-  file.symlink:
-    - name: /opt/so/saltstack/local/salt/suricata/rules
-    - target: /opt/so/rules/nids
-
 suridatadir:
   file.directory:
     - name: /nsm/suricata
diff --git a/salt/suricata/master.sls b/salt/suricata/master.sls
new file mode 100644
index 000000000..6ad1e7c94
--- /dev/null
+++ b/salt/suricata/master.sls
@@ -0,0 +1,17 @@
+include:
+  - salt.master.refresh_fileserver
+
+surilocaldir:
+  file.directory:
+    - name: /opt/so/saltstack/local/salt/suricata
+    - user: 940
+    - group: 940
+    - makedirs: True
+
+ruleslink:
+  file.symlink:
+    - name: /opt/so/saltstack/local/salt/suricata/rules
+    - target: /opt/so/rules/nids
+    - watch_in: 
+      - saltmod: refresh_salt_master_fileserver
+    
\ No newline at end of file
diff --git a/salt/top.sls b/salt/top.sls
index 4d60b01c0..5c070a5da 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -30,6 +30,7 @@ base:
     - telegraf
     - firewall
     - idstools
+    - suricata.master
     - pcap
     - suricata
     - zeek
@@ -73,6 +74,7 @@ base:
     - soc
     - firewall
     - idstools
+    - suricata.master
     - healthcheck
     {%- if FLEETMASTER or FLEETNODE or PLAYBOOK != 0 %}
     - mysql
@@ -129,6 +131,7 @@ base:
     - firewall
     - master
     - idstools
+    - suricata.master
     - redis
     {%- if FLEETMASTER or FLEETNODE or PLAYBOOK != 0 %}
     - mysql
@@ -174,6 +177,7 @@ base:
     - soc
     - firewall
     - idstools
+    - suricata.master    
     - healthcheck
     - redis
     {%- if FLEETMASTER or FLEETNODE or PLAYBOOK != 0 %}