diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index d27f291eb..e6fec1c6b 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -873,440 +873,6 @@ elasticsearch:
             name: elastic_agent
           managed_by: security_onion
           managed: true
-    so-aws:
-      warm: 7
-      close: 30
-      delete: 365
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-aws-*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - aws-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-azure:
-      warm: 7
-      close: 30
-      delete: 365
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-azure-*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - azure-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-barracuda:
-      warm: 7
-      close: 30
-      delete: 365
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-barracuda-*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-beats:
-      warm: 7
-      close: 30
-      delete: 365
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-beats-*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-          - winlog-mappings
-          - dtc-winlog-mappings
-        priority: 500
-    so-bluecoat:
-      warm: 7
-      close: 30
-      delete: 365
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-bluecoat-*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
     so-case:
       index_sorting: False
       index_template:
@@ -1336,258 +902,6 @@ elasticsearch:
           - case-mappings
           - case-settings
         priority: 500
-    so-cef:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-cef*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - cef-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-checkpoint:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-checkpoint*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - checkpoint-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-cisco:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-cisco*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - cisco-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
     so-common:
       warm: 7
       close: 30
@@ -1678,278 +992,6 @@ elasticsearch:
           - common-dynamic-mappings
           - winlog-mappings
         priority: 1
-    so-cyberark:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-cyberark*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - cyberark-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-cylance:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-cylance*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-elasticsearch:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - logs-elasticsearch-default*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              lifecycle:
-                name: so-elasticsearch-logs
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - elasticsearch-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-      policy:
-        phases:
-          hot:
-            min_age: 0ms
-            actions:
-              set_priority:
-                priority: 100
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-          cold:
-            min_age: 30d
-            actions:
-              set_priority:
-                priority: 0
-          delete:
-            min_age: 365d
-            actions:
-              delete: {}
     so-endgame:
       index_sorting: False
       index_template:
@@ -2035,509 +1077,6 @@ elasticsearch:
           - common-dynamic-mappings
           - winlog-mappings
         priority: 500
-    so-f5:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-f5*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-firewall:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-firewall*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - syslog-mappings
-          - dtc-syslog-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-flow:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-flow*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-fortinet:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-fortinet*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - fortinet-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-gcp:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-gcp*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - gcp-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-google_workspace:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-google_workspace*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - google_workspace-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
     so-idh:
       warm: 7
       close: 30
@@ -2724,89 +1263,6 @@ elasticsearch:
             min_age: 365d
             actions:
               delete: {}
-    so-imperva:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-imperva*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
     so-import:
       index_sorting: False
       index_template:
@@ -2913,277 +1369,6 @@ elasticsearch:
             min_age: 365d
             actions:
               delete: {}
-    so-infoblox:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-infoblox*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-          - winlog-mappings
-        priority: 500
-    so-juniper:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-juniper*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - juniper-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-kibana:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-kibana*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - kibana-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-      policy:
-        phases:
-          hot:
-            min_age: 0ms
-            actions:
-              set_priority:
-                priority: 100
-              rollover:
-                max_age: 30d
-                max_primary_shard_size: 50gb
-          cold:
-            min_age: 30d
-            actions:
-              set_priority:
-                priority: 0
-          delete:
-            min_age: 365d
-            actions:
-              delete: {}
     so-kratos:
       warm: 7
       close: 30
@@ -3391,843 +1576,6 @@ elasticsearch:
             min_age: 365d
             actions:
               delete: {}
-    so-microsoft:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-microsoft*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - microsoft-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-misp:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-misp*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - misp-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-netflow:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-netflow*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - netflow-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-netscout:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-netscout*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-o365:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-o365*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - o365-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-okta:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-okta*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - okta-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-osquery:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-osquery*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-          - winlog-mappings
-        priority: 500
-    so-ossec:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-ossec*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-          - winlog-mappings
-        priority: 500
-    so-proofpoint:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-proofpoint*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-radware:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-radware*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
     so-redis:
       index_sorting: False
       index_template:
@@ -4333,423 +1681,6 @@ elasticsearch:
             min_age: 365d
             actions:
               delete: {}
-    so-snort:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-snort*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-snyk:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-snyk*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - snyk-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-sonicwall:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-sonicwall*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-sophos:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-sophos*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - sophos-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
-    so-squid:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-squid*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
     so-strelka:
       index_sorting: False
       index_template:
@@ -4959,89 +1890,6 @@ elasticsearch:
             min_age: 365d
             actions:
               delete: {}
-    so-tomcat:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-tomcat*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500
     so-zeek:
       index_sorting: False
       index_template:
@@ -5150,86 +1998,3 @@ elasticsearch:
             min_age: 365d
             actions:
               delete: {}
-    so-zscaler:
-      index_sorting: False
-      index_template:
-        index_patterns:
-          - so-zscaler*
-        template:
-          mappings:
-            dynamic_templates:
-              - strings_as_keyword:
-                  mapping:
-                    ignore_above: 1024
-                    type: keyword
-                  match_mapping_type: string
-            date_detection: false
-          settings:
-            index:
-              mapping:
-                total_fields:
-                  limit: 5000
-              sort:
-                field: "@timestamp"
-                order: desc
-              refresh_interval: 30s
-              number_of_shards: 1
-              number_of_replicas: 0
-        composed_of: 
-          - agent-mappings
-          - dtc-agent-mappings
-          - base-mappings
-          - dtc-base-mappings
-          - client-mappings
-          - dtc-client-mappings
-          - cloud-mappings
-          - container-mappings
-          - data_stream-mappings
-          - destination-mappings
-          - dtc-destination-mappings
-          - pb-override-destination-mappings
-          - dll-mappings
-          - dns-mappings
-          - dtc-dns-mappings
-          - ecs-mappings
-          - dtc-ecs-mappings
-          - error-mappings
-          - event-mappings
-          - dtc-event-mappings
-          - file-mappings
-          - dtc-file-mappings
-          - group-mappings
-          - host-mappings
-          - dtc-host-mappings
-          - http-mappings
-          - dtc-http-mappings
-          - log-mappings
-          - network-mappings
-          - dtc-network-mappings
-          - observer-mappings
-          - dtc-observer-mappings
-          - orchestrator-mappings
-          - organization-mappings
-          - package-mappings
-          - process-mappings
-          - dtc-process-mappings
-          - registry-mappings
-          - related-mappings
-          - rule-mappings
-          - dtc-rule-mappings
-          - server-mappings
-          - service-mappings
-          - dtc-service-mappings
-          - source-mappings
-          - dtc-source-mappings
-          - pb-override-source-mappings
-          - threat-mappings
-          - tls-mappings
-          - tracing-mappings
-          - url-mappings
-          - user_agent-mappings
-          - dtc-user_agent-mappings
-          - vulnerability-mappings
-          - common-settings
-          - common-dynamic-mappings
-        priority: 500