diff --git a/salt/firewall/soc_firewall.yaml b/salt/firewall/soc_firewall.yaml
index 8389f2f7e..2f18406c4 100644
--- a/salt/firewall/soc_firewall.yaml
+++ b/salt/firewall/soc_firewall.yaml
@@ -1,5 +1,5 @@
 firewall:
-  hostgroups2:
+  hostgroups:
     analyst_workstations:
       description: List of IP Addresses or CIDR blocks to allow analyst workstations.
       file: True