From e62b52da1b39c360493703ba4ad19159a766fac0 Mon Sep 17 00:00:00 2001
From: William Wernert <william.wernert@gmail.com>
Date: Fri, 20 Nov 2020 09:58:07 -0500
Subject: [PATCH] [fix] Add condition to zeek state during setup for
 ZEEKVERSION

Fixes #1990
---
 setup/so-setup    | 8 +++++---
 setup/so-whiptail | 3 ++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/setup/so-setup b/setup/so-setup
index e1550ff03..22e429ad4 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -639,12 +639,14 @@ fi
 		salt-call state.apply -l info pcap >> $setup_log 2>&1
 	fi
 
-	if [[ $is_sensor || $is_import ]]; then
+	if [[ $is_sensor || $is_import || $is_helix ]]; then
 		set_progress_str 66 "$(print_salt_state_apply 'suricata')"
 		salt-call state.apply -l info suricata >> $setup_log 2>&1
 
-		set_progress_str 67 "$(print_salt_state_apply 'zeek')"
-		salt-call state.apply -l info zeek >> $setup_log 2>&1
+		if [[ $ZEEKVERSION == 'ZEEK' ]]; then
+			set_progress_str 67 "$(print_salt_state_apply 'zeek')"
+			salt-call state.apply -l info zeek >> $setup_log 2>&1
+		fi
 	fi
 
 	if [[ $is_node ]]; then
diff --git a/setup/so-whiptail b/setup/so-whiptail
index bf40a99dd..11d968910 100755
--- a/setup/so-whiptail
+++ b/setup/so-whiptail
@@ -97,7 +97,8 @@ whiptail_zeek_version() {
 
 	[ -n "$TESTING" ] && return
 
-	ZEEKVERSION=$(whiptail --title "Security Onion Setup" --radiolist "What tool would you like to use to generate metadata?" 20 75 4 "ZEEK" "Zeek (formerly known as Bro)"  ON \
+	ZEEKVERSION=$(whiptail --title "Security Onion Setup" --radiolist "What tool would you like to use to generate metadata?" 20 75 4 \
+	"ZEEK" "Zeek (formerly known as Bro)"  ON \
 	"SURICATA" "Suricata" OFF 3>&1 1>&2 2>&3)
 
 	local exitstatus=$?