diff --git a/salt/elasticfleet/config.sls b/salt/elasticfleet/config.sls
index 4ff284ffa..d29b9ddb2 100644
--- a/salt/elasticfleet/config.sls
+++ b/salt/elasticfleet/config.sls
@@ -113,8 +113,12 @@ elasticdefendcustom:
     - mode: 600
 
 {% if ELASTICFLEETMERGED.config.defend_filters.enable_auto_configuration %}
-cron-elastic-defend-filters-add:
-  cron.present:
+{%   set ap = "present" %}
+{% else %}
+{%   set ap = "absent" %}
+{% endif %}
+cron-elastic-defend-filters:
+  cron.{{ap}}:
     - name: python3 /sbin/so-elastic-defend-manage-filters.py -c /opt/so/conf/elasticsearch/curl.config -d /opt/so/conf/elastic-fleet/defend-exclusions/disabled-filters.yaml -i /nsm/securityonion-resources/event_filters/ -i /opt/so/conf/elastic-fleet/defend-exclusions/rulesets/custom-filters/ &>> /opt/so/log/elasticfleet/elastic-defend-manage-filters.log
     - identifier: elastic-defend-filters
     - user: root
@@ -123,11 +127,6 @@ cron-elastic-defend-filters-add:
     - daymonth: '*'
     - month: '*'
     - dayweek: '*'
-{% else %}
-cron-elastic-defend-filters-remove:
-  cron.absent:
-    - identifier: elastic-defend-filters
-{% endif %}
 
 eaintegrationsdir:
   file.directory: