diff --git a/salt/strelka/init.sls b/salt/strelka/init.sls
index 660b85ef5..be25df96a 100644
--- a/salt/strelka/init.sls
+++ b/salt/strelka/init.sls
@@ -109,6 +109,6 @@ strelka_filestream:
     
 strelka_zeek_extracted_sync:
   cron.present:
-    - user: socore
+    - user: root
     - name: mv /nsm/zeek/extracted/complete/* /nsm/strelka
     - minute: '*'