From ca807bd6bd415b4def623a2e58ad710ac38f424b Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Thu, 4 Apr 2024 16:58:39 -0400
Subject: [PATCH] Use list not string

---
 salt/soc/merged.map.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
index 4cd08a218..ae68dc01f 100644
--- a/salt/soc/merged.map.jinja
+++ b/salt/soc/merged.map.jinja
@@ -32,7 +32,7 @@
 
 {# do not automatically enable Sigma rules if install is Eval or Import #}
 {% if grains['role'] in ['so-eval', 'so-import'] %}
-  {%   do SOCMERGED.config.server.modules.elastalertengine.update({'autoEnabledSigmaRules': ""}) %}
+  {%   do SOCMERGED.config.server.modules.elastalertengine.update({'autoEnabledSigmaRules': []}) %}
 {% endif %}
 
 {# remove these modules if detections is disabled #}