Merge remote-tracking branch 'origin/cogburn/detection_playbooks' into kilo

salt/soc/defaults.yaml

@@ -64,7 +64,7 @@ soc:
         icon: fa-external-link-alt
         target: _blank
         links:
-          - 'https://{:sublime.url}/messages/{:sublime.message_group_id}' 
+          - 'https://{:sublime.url}/messages/{:sublime.message_group_id}'
       - name: actionProcessAncestors
         description: actionProcessAncestorsHelp
         icon: fa-people-roof
@@ -1012,7 +1012,8 @@ soc:
           communityRulesImportFrequencySeconds: 180
           elastAlertRulesFolder: /opt/sensoroni/elastalert
           rulesFingerprintFile: /opt/sensoroni/fingerprints/sigma.fingerprint
-          sigmaRulePackages: core
+          sigmaRulePackages:
+            - core
         elastic:
           hostUrl:
           remoteHostUrls: []