From e105bd12e6f95b60b7f07905013aa4dcc29d49eb Mon Sep 17 00:00:00 2001
From: DefensiveDepth <josh@defensivedepth.com>
Date: Tue, 9 Dec 2025 09:49:27 -0500
Subject: [PATCH] Fix custom name

---
 salt/soc/merged.map.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
index 1d9946a05..349937983 100644
--- a/salt/soc/merged.map.jinja
+++ b/salt/soc/merged.map.jinja
@@ -83,7 +83,7 @@
 {# Always append the custom ruleset to suricataengine.rulesetSources if not already present #}
 {% if SOCMERGED.config.server.modules.suricataengine is defined and SOCMERGED.config.server.modules.suricataengine.rulesetSources is defined %}
 {%   if SOCMERGED.config.server.modules.suricataengine.rulesetSources is not mapping %}
-{%     set custom_names = SOCMERGED.config.server.modules.suricataengine.rulesetSources | selectattr('name', 'equalto', 'custom') | list %}
+{%     set custom_names = SOCMERGED.config.server.modules.suricataengine.rulesetSources | selectattr('name', 'equalto', '__custom__') | list %}
 {%     if custom_names | length == 0 %}
 {%       do SOCMERGED.config.server.modules.suricataengine.rulesetSources.append(CUSTOM_RULESET) %}
 {%     endif %}