Disable by default

salt/elasticfleet/config.sls

@@ -85,7 +85,7 @@ soresourcesrepoclone:
   git.latest:
     - name: https://github.com/Security-Onion-Solutions/securityonion-resources.git
     - target: /nsm/securityonion-resources
-    - rev: 'dev/defend_filters'
+    - rev: 'main'
     - depth: 1
 {% endif %}
 
@@ -112,6 +112,7 @@ elasticdefendcustom:
     - group: 939
     - mode: 600
 
+{% if ELASTICFLEETMERGED.config.defend_filters.enable_auto_configuration %}
 cronelasticdefendfilters:
   cron.present:
     - name: python3 /sbin/so-elastic-defend-manage-filters.py -c /opt/so/conf/elasticsearch/curl.config -d /opt/so/conf/elastic-fleet/defend-exclusions/disabled-filters.yaml -i /nsm/securityonion-resources/event_filters/ -i /opt/so/conf/elastic-fleet/defend-exclusions/rulesets/custom-filters/ &>> /opt/so/log/elasticfleet/elastic-defend-manage-filters.log
@@ -122,6 +123,7 @@ cronelasticdefendfilters:
     - daymonth: '*'
     - month: '*'
     - dayweek: '*'
+{% endif %}
 
 eaintegrationsdir:
   file.directory: