From b452e704193313d0bb8d027bed3833004c632c65 Mon Sep 17 00:00:00 2001
From: Mike Reeves <reevesmk@gmail.com>
Date: Tue, 17 Mar 2026 09:37:37 -0400
Subject: [PATCH] Keep JA4S_raw and JA4H_raw hardcoded to disabled

---
 salt/zeek/files/config.zeek.ja4 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/zeek/files/config.zeek.ja4 b/salt/zeek/files/config.zeek.ja4
index cc82ddcf8..eb9da37b4 100644
--- a/salt/zeek/files/config.zeek.ja4
+++ b/salt/zeek/files/config.zeek.ja4
@@ -9,12 +9,12 @@ export {
 
   # FoxIO license required for JA4+
   option JA4S_enabled:   bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
-  option JA4S_raw:   bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
+  option JA4S_raw:   bool = F;
 
   option JA4D_enabled:  bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
 
   option JA4H_enabled:   bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
-  option JA4H_raw:   bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};
+  option JA4H_raw:   bool = F;
 
   option JA4L_enabled:   bool = {{ 'T' if JA4PLUS_ENABLED else 'F' }};