diff --git a/salt/strelka/filestream/config.sls b/salt/strelka/filestream/config.sls
index 9c0ef1357..193241f32 100644
--- a/salt/strelka/filestream/config.sls
+++ b/salt/strelka/filestream/config.sls
@@ -78,15 +78,6 @@ filecheck_script:
     - group: 939
     - mode: 755
 
-filecheck_restart:
-  cmd.run:
-    - name: pkill -f "python3 /opt/so/conf/strelka/filecheck"
-    - hide_output: True
-    - success_retcodes: [0,1]
-    - onchanges:
-      - file: filecheck_script
-      - file: filecheck_conf
-
 {% if GLOBALS.md_engine == 'ZEEK' %}
 
 filecheck_run_socore:
@@ -115,6 +106,15 @@ remove_filecheck_run_socore:
 
 {% endif %}
 
+filecheck_restart:
+  cmd.run:
+    - name: pkill -f "python3 /opt/so/conf/strelka/filecheck"
+    - hide_output: True
+    - success_retcodes: [0,1]
+    - onchanges:
+      - file: filecheck_script
+      - file: filecheck_conf
+
 filcheck_history_clean:
   cron.present:
     - name: '/usr/bin/find /nsm/strelka/history/ -type f -mtime +2 -exec rm {} + > /dev/null 2>&1'