Merge pull request #12974 from Security-Onion-Solutions/fix/strelka_yara

Account for 0 active rules and change watch

salt/strelka/backend/enabled.sls

@@ -42,6 +42,8 @@ strelka_backend:
       {% endfor %}
     {% endif %}
     - restart_policy: on-failure
+    - watch:
+      - file: /opt/so/conf/strelka/rules/compiled/*
 
 delete_so-strelka-backend_so-status.disabled:
   file.uncomment:

salt/strelka/config.sls

@@ -31,11 +31,12 @@ strelkarulesdir:
 
 {%- if grains.role in ['so-sensor', 'so-heavynode'] %}
 strelkasensorrules:
-  file.managed:
-    - name: /opt/so/conf/strelka/rules/compiled/rules.compiled
-    - source: salt://strelka/rules/compiled/rules.compiled
+  file.recurse:
+    - name: /opt/so/conf/strelka/rules/compiled/
+    - source: salt://strelka/rules/compiled/
     - user: 939
     - group: 939
+    - clean: True
 {%- endif %}
 
 strelkareposdir: