From 66c9e20c6a0d639ae2da42db384af79da96ecf14 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Fri, 7 Jan 2022 15:57:08 -0500
Subject: [PATCH] Add wilcards for CCS compatibility

---
 salt/soc/files/soc/soc.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json
index 126577edc..ae28183fd 100644
--- a/salt/soc/files/soc/soc.json
+++ b/salt/soc/files/soc/soc.json
@@ -167,7 +167,7 @@
         "eventFields": {{ hunt_eventfields | json }},
         "queryBaseFilter": "",
         "queryToggleFilters": [
-          { "name": "caseExcludeToggle", "filter": "NOT _index:so-case*", "enabled": true }
+          { "name": "caseExcludeToggle", "filter": "NOT _index:\"*:so-case*\"", "enabled": true }
         ],
         "queries": {{ hunt_queries | json }},
         "actions": {{ menu_actions | json }}