From afcb30be0383b353b80f5b6985934adbb1bb252a Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 30 Aug 2024 09:43:35 -0400
Subject: [PATCH] Threhsolds require a restart

---
 salt/suricata/enabled.sls | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls
index cd2f38951..3f1469f0f 100644
--- a/salt/suricata/enabled.sls
+++ b/salt/suricata/enabled.sls
@@ -56,10 +56,12 @@ so-suricata:
     {% endif %}
     - watch:
       - file: suriconfig
+      - file: surithresholding
       - file: /opt/so/conf/suricata/bpf
       - file: suriclassifications
     - require:
       - file: suriconfig
+      - file: surithresholding
       - file: suribpf
       - file: suriclassifications
 
@@ -68,11 +70,10 @@ surirulereload:
     - name: /usr/sbin/so-suricata-reload-rules >> /opt/so/log/suricata/reload.log 2>&1
     - onchanges: 
         - surirulesync
-        - surithresholding
     
 delete_so-suricata_so-status.disabled:
   file.uncomment:
-    - name: /opt/so/conf/so-status/so-status.conf 
+    - name: /opt/so/conf/so-status/so-status.conf
     - regex: ^so-suricata$
 
 # Add eve clean cron