diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index ec1e07425..d19041503 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1482,7 +1482,7 @@ soc:
             query: 'event.dataset:snmp | groupby snmp.community | groupby snmp.version | groupby -sankey source.ip destination.ip | groupby source.ip | groupby destination.ip | groupby destination.port'
           - name: Software
             description: Software seen by Zeek via network traffic
-            query: 'event.dataset:software | groupby software.type | groupby software.name | groupby source.ip'
+            query: 'event.dataset:software | groupby -sankey software.type source.ip | groupby software.type | groupby software.name | groupby source.ip'
           - name: SSH
             description: SSH (Secure Shell) connections seen by Zeek
             query: 'event.dataset:ssh | groupby ssh.client | groupby ssh.server | groupby -sankey source.ip destination.ip | groupby ssh.direction | groupby ssh.version | groupby ssh.hassh_version | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name'