From dfd25567e14bc38a743fcdff03234127a0e2eb3b Mon Sep 17 00:00:00 2001
From: Mike Reeves <luke@geekempire.com>
Date: Mon, 18 Mar 2019 15:17:31 -0400
Subject: [PATCH] Setup Script - Turn off wazuh and osq by default in eval mode

---
 salt/top.sls | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/salt/top.sls b/salt/top.sls
index fcd68f1eb..0d6476779 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -1,4 +1,6 @@
 {%- set BROVER = salt['pillar.get']('static:broversion', 'COMMUNITY') %}
+{%- set OSQUERY = salt['pillar.get']('master:osquery', '0') %}
+{%- set WAZUH = salt['pillar.get']('master:wazuh', '0') %}
 base:
   'G@role:so-sensor':
     - ca
@@ -31,8 +33,12 @@ base:
     - curator
     - elastalert
     - redis
+    {%- if OSQUERY != '0' %}
     - fleet
+    {%- endif %}
+    {%- if WAZUH != '0' %}
     - wazuh
+    {%- endif %}
     - filebeat
     - utility
     - schedule