diff --git a/salt/filebeat/thirdpartydefaults.yaml b/salt/filebeat/thirdpartydefaults.yaml
index 027ec4595..cfb8d10d9 100644
--- a/salt/filebeat/thirdpartydefaults.yaml
+++ b/salt/filebeat/thirdpartydefaults.yaml
@@ -195,9 +195,10 @@ third_party_filebeat:
         var.syslog_port: 9502
     o365:
       audit:
-      enabled: false
+        enabled: false
     okta:
-      enabled: false
+      system:
+        enabled: false
     pesando:
       dfw:
         enabled: false