From 93024738d31715f9b613520e9adbc0d7b1d4d262 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 21 Jul 2025 10:57:45 -0400
Subject: [PATCH] Update config.sls

---
 salt/zeek/config.sls | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/salt/zeek/config.sls b/salt/zeek/config.sls
index 7fdbd8560..761c6f7d3 100644
--- a/salt/zeek/config.sls
+++ b/salt/zeek/config.sls
@@ -150,6 +150,13 @@ plcronscript:
     - source: salt://zeek/cron/packetloss.sh
     - mode: 755
 
+zeekja4cfg:
+  file.managed:
+    - name: /opt/so/conf/zeek/config.zeek
+    - source: salt://zeek/files/config.zeek.ja4
+    - user: 937
+    - group: 939
+
 # BPF compilation and configuration
 {% if ZEEKBPF %}
    {% set BPF_CALC = salt['cmd.script']('salt://common/tools/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + ZEEKBPF|join(" "),cwd='/root') %}