diff --git a/salt/_modules/needs_restarting.py b/salt/_modules/needs_restarting.py
index 49f82bbf2..5afb6f02a 100644
--- a/salt/_modules/needs_restarting.py
+++ b/salt/_modules/needs_restarting.py
@@ -4,20 +4,19 @@ import subprocess
 def check():
 
   os = __grains__['os']
+  retval = 'False'
 
   if os == 'Ubuntu':
     if path.exists('/var/run/reboot-required'):
       retval = 'True'
-    else:
-      retval = 'False'
 
   elif os == 'CentOS':
     cmd = 'needs-restarting -r > /dev/null 2>&1'
+    
     try:
-      needs_restarting = subprocess.check_call(cmd.split(), shell=True)
+      needs_restarting = subprocess.check_call(cmd, shell=True)
     except subprocess.CalledProcessError:
       retval = 'True'
-    retval = 'False'
 
   else:
     retval = 'Unsupported OS: %s' % os
diff --git a/salt/hive/thehive/etc/application.conf b/salt/hive/thehive/etc/application.conf
index 6cc72813e..3b6c89637 100644
--- a/salt/hive/thehive/etc/application.conf
+++ b/salt/hive/thehive/etc/application.conf
@@ -1,5 +1,5 @@
 {%- set MASTERIP = salt['pillar.get']('static:masterip', '') %}
-{%- set CORTEXKEY = salt['pillar.get']('static:cortexkey', '') %}
+{%- set CORTEXKEY = salt['pillar.get']('static:cortexorguserkey', '') %}
 
 # Secret Key
 # The secret key is used to secure cryptographic functions.
diff --git a/salt/hive/thehive/scripts/cortex_init.sh b/salt/hive/thehive/scripts/cortex_init.sh
index 3596c98dd..506b14be5 100644
--- a/salt/hive/thehive/scripts/cortex_init.sh
+++ b/salt/hive/thehive/scripts/cortex_init.sh
@@ -3,6 +3,9 @@
 {%- set CORTEXUSER = salt['pillar.get']('static:cortexuser', '') %}
 {%- set CORTEXPASSWORD = salt['pillar.get']('static:cortexpassword', '') %}
 {%- set CORTEXKEY = salt['pillar.get']('static:cortexkey', '') %}
+{%- set CORTEXORGNAME = salt['pillar.get']('static:cortexorgname', '') %}
+{%- set CORTEXORGUSER = salt['pillar.get']('static:cortexorguser', '') %}
+{%- set CORTEXORGUSERKEY = salt['pillar.get']('static:cortexorguserkey', '') %}
 
 cortex_init(){
     sleep 60
@@ -10,17 +13,34 @@ cortex_init(){
     CORTEX_USER="{{CORTEXUSER}}"
     CORTEX_PASSWORD="{{CORTEXPASSWORD}}"
     CORTEX_KEY="{{CORTEXKEY}}"    
+    CORTEX_ORG_NAME="{{CORTEXORGNAME}}"
+    CORTEX_ORG_DESC="{{CORTEXORGNAME}} organization created by Security Onion setup"
+    CORTEX_ORG_USER="{{CORTEXORGUSER}}"
+    CORTEX_ORG_USER_KEY="{{CORTEXORGUSERKEY}}"
     SOCTOPUS_CONFIG="/opt/so/saltstack/salt/soctopus/files/SOCtopus.conf"
 
+
     # Migrate DB
     curl -v -k -XPOST "https://$CORTEX_IP:/cortex/api/maintenance/migrate"
 
-    # Create intial Cortex user
+    # Create intial Cortex superadmin
     curl -v -k "https://$CORTEX_IP/cortex/api/user" -H "Content-Type: application/json" -d "{\"login\" : \"$CORTEX_USER\",\"name\" : \"$CORTEX_USER\",\"roles\" : [\"superadmin\"],\"preferences\" : \"{}\",\"password\" : \"$CORTEX_PASSWORD\", \"key\": \"$CORTEX_KEY\"}"
 
-    # Enable URLScan.io Analyzer
-    curl -v -k -XPOST -H "Authorization: Bearer $CORTEX_KEY" -H "Content-Type: application/json" "https://$CORTEX_IP/cortex/api/organization/analyzer/Urlscan_io_Search_0_1_0" -d '{"name":"Urlscan_io_Search_0_1_0","configuration":{"auto_extract_artifacts":false,"check_tlp":true,"max_tlp":2}}'
+    # Create user-supplied org
+    curl -k -XPOST -H "Authorization: Bearer $CORTEX_KEY" -H "Content-Type: application/json" "https://$CORTEX_IP/cortex/api/organization" -d "{  \"name\": \"$CORTEX_ORG_NAME\",\"description\": \"$CORTEX_ORG_DESC\",\"status\": \"Active\"}"
     
+    # Create user-supplied org user
+    curl -k -XPOST -H "Authorization: Bearer $CORTEX_KEY" -H "Content-Type: application/json" "https://$CORTEX_IP/cortex/api/user" -d "{\"name\": \"$CORTEX_ORG_USER\",\"roles\": [\"read\",\"analyze\",\"orgadmin\"],\"organization\": \"$CORTEX_ORG_NAME\",\"login\": \"$CORTEX_ORG_USER\",\"key\": \"$CORTEX_ORG_USER_KEY\" }"
+
+    # Enable URLScan.io Analyzer
+    curl -v -k -XPOST -H "Authorization: Bearer $CORTEX_ORG_USER_KEY" -H "Content-Type: application/json" "https://$CORTEX_IP/cortex/api/organization/analyzer/Urlscan_io_Search_0_1_0" -d '{"name":"Urlscan_io_Search_0_1_0","configuration":{"auto_extract_artifacts":false,"check_tlp":true,"max_tlp":2}}'
+
+    # Enable Cert PassiveDNS Analyzer
+    curl -v -k -XPOST -H "Authorization: Bearer $CORTEX_ORG_USER_KEY" -H "Content-Type: application/json" "https://$CORTEX_IP/cortex/api/organization/analyzer/CERTatPassiveDNS_2_0" -d '{"name":"CERTatPassiveDNS_2_0","configuration":{"auto_extract_artifacts":false,"check_tlp":true,"max_tlp":2, "limit": 100}}'
+	
+    # Revoke $CORTEX_USER key
+    curl -k -XDELETE -H "Authorization: Bearer $CORTEX_KEY" "https:///$CORTEX_IP/api/user/$CORTEX_USER/key" 
+
     # Update SOCtopus config with apikey value
     #sed -i "s/cortex_key = .*/cortex_key = $CORTEX_KEY/" $SOCTOPUS_CONFIG
 
diff --git a/salt/logstash/files/dynamic/0006_input_beats.conf b/salt/logstash/files/dynamic/0006_input_beats.conf
index 1a6b66bbe..a7140f859 100644
--- a/salt/logstash/files/dynamic/0006_input_beats.conf
+++ b/salt/logstash/files/dynamic/0006_input_beats.conf
@@ -9,23 +9,6 @@ input {
   }
 }
 filter {
-  if [type] == "ids" or [type] =~ "bro" {
-    mutate {
-      rename => { "host" => "beat_host" }
-      remove_tag => ["beat"]
-      add_field => { "sensor_name" => "%{[beat][name]}" }
-      add_field => { "syslog-host_from" => "%{[beat][name]}" }
-      remove_field => [ "beat", "prospector", "input", "offset" ]
-    }
-  }
-  if [type] =~ "ossec" {
-    mutate {
-      rename => { "host" => "beat_host" }
-      remove_tag => ["beat"]
-      add_field => { "syslog-host_from" => "%{[beat][name]}" }
-      remove_field => [ "beat", "prospector", "input", "offset" ]
-    }
-   }
     if [type] == "osquery" {
     mutate {
       rename => { "host" => "beat_host" }
diff --git a/salt/motd/init.sls b/salt/motd/init.sls
index a314ddb80..4dae979bf 100644
--- a/salt/motd/init.sls
+++ b/salt/motd/init.sls
@@ -1,5 +1,5 @@
 package_update_reboot_required_motd:
-  file.append:
+  file.managed:
     - name: /etc/motd
     - source: salt://motd/files/package_update_reboot_required.jinja
     - template: jinja
diff --git a/salt/patch/needs_restarting.sls b/salt/patch/needs_restarting.sls
new file mode 100644
index 000000000..f60909d22
--- /dev/null
+++ b/salt/patch/needs_restarting.sls
@@ -0,0 +1,5 @@
+needs_restarting:
+  module.run:
+    - mine.send:
+      - func: needs_restarting.check
+    - order: last
diff --git a/salt/patch/os/init.sls b/salt/patch/os/init.sls
index 97183199b..7f2adc65b 100644
--- a/salt/patch/os/init.sls
+++ b/salt/patch/os/init.sls
@@ -1,5 +1,6 @@
-{% if grains.os == "CentOS" %}
 include:
+  - patch.needs_restarting
+{% if grains.os == "CentOS" %}
   - yum.packages
 {% endif %}
 
@@ -7,8 +8,3 @@ patch_os:
   pkg.uptodate:
     - name: patch_os
     - refresh: True
-
-needs_restarting:
-  module.run:
-    - mine.send:
-      - func: needs_restarting.check
diff --git a/salt/top.sls b/salt/top.sls
index 46745a38b..a2662a89b 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -7,6 +7,7 @@
 base:
   '*':
     - patch.os.schedule
+    - patch.needs_restarting
     - motd
 
   'G@role:so-sensor':
diff --git a/so-setup-network.sh b/so-setup-network.sh
index c68a39fca..c32635574 100644
--- a/so-setup-network.sh
+++ b/so-setup-network.sh
@@ -415,6 +415,7 @@ generate_passwords(){
   FLEETPASS=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1)
   HIVEKEY=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1)
   CORTEXKEY=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1)
+  CORTEXORGUSERKEY=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1)
   SENSORONIKEY=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1)
 }
 
@@ -582,6 +583,9 @@ master_static() {
   echo "  cortexuser: cortexadmin" >> /opt/so/saltstack/pillar/static.sls
   echo "  cortexpassword: cortexchangeme" >> /opt/so/saltstack/pillar/static.sls
   echo "  cortexkey: $CORTEXKEY" >> /opt/so/saltstack/pillar/static.sls
+  echo "  cortexorgname: SecurityOnion" >> /opt/so/saltstack/pillar/static.sls
+  echo "  cortexorguser: soadmin" >> /opt/so/saltstack/pillar/static.sls
+  echo "  cortexorguserkey: $CORTEXORGUSERKEY" >> /opt/so/saltstack/pillar/static.sls
   echo "  fleetsetup: 0" >> /opt/so/saltstack/pillar/static.sls
   echo "  sensoronikey: $SENSORONIKEY" >> /opt/so/saltstack/pillar/static.sls
   if [[ $MASTERUPDATES == 'MASTER' ]]; then