diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 39960d946..9f5faf50b 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1273,6 +1273,7 @@ soc:
         - observer.ip
       ':soc:':
         - soc_timestamp
+        - event.dataset
         - source.ip
         - soc.fields.requestMethod
         - soc.fields.requestPath