From 72a4ba405f37a655c78d7a0cef373d3e404c017f Mon Sep 17 00:00:00 2001
From: DefensiveDepth <josh@defensivedepth.com>
Date: Mon, 8 Dec 2025 16:45:40 -0500
Subject: [PATCH] match correct custom ruleset name

---
 salt/soc/merged.map.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
index 4c301fa9d..1d9946a05 100644
--- a/salt/soc/merged.map.jinja
+++ b/salt/soc/merged.map.jinja
@@ -70,7 +70,7 @@
 
 {# Define the Detections custom ruleset that should always be present #}
 {% set CUSTOM_RULESET = {
-  'name': 'custom',
+  'name': '__custom__',
   'description': 'User-created custom rules created via the Detections module in the SOC UI',
   'sourceType': 'elasticsearch',
   'sourcePath': 'so_detection.ruleset:__custom__',