From 2fcfb06ba5ec2c4be7cce4bddc3acad7d49fbe27 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Wed, 1 Apr 2020 11:41:56 -0400
Subject: [PATCH] Update Eval for Strelka

---
 salt/top.sls | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/salt/top.sls b/salt/top.sls
index 456e09420..011655bde 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -6,6 +6,7 @@
 {%- set DOMAINSTATS = salt['pillar.get']('master:domainstats', '0') -%}
 {%- set FLEETMASTER = salt['pillar.get']('static:fleet_master', False) -%}
 {%- set FLEETNODE = salt['pillar.get']('static:fleet_node', False) -%}
+{%- set STRELKA = salt['pillar.get']('master:strelka', '1') -%
 
 
 base:
@@ -63,11 +64,14 @@ base:
     - wazuh
     {%- endif %}
     - elasticsearch
-    - filebeat
     - kibana
     - pcap
     - suricata
     - zeek
+    {%- if STRELKA %}
+    - strelka
+    {%- endif %}
+    - filebeat
     - curator
     - elastalert
     {%- if FLEETMASTER or FLEETNODE %}