Simplify check

salt/soc/defaults.yaml

@@ -1445,7 +1445,7 @@ soc:
             default:
               - repo: https://github.com/Security-Onion-Solutions/securityonion-resources
                 license: Elastic-2.0
-                folder: sigma/stable
+                folder: sigma
                 community: true
                 rulesetName: securityonion-resources
               - repo: file:///nsm/rules/custom-local-repos/local-sigma
@@ -1455,7 +1455,7 @@ soc:
             airgap:
               - repo: file:///nsm/rules/detect-sigma/repos/securityonion-resources
                 license: Elastic-2.0
-                folder: sigma/stable
+                folder: sigma
                 community: true
                 rulesetName: securityonion-resources
               - repo: file:///nsm/rules/custom-local-repos/local-sigma

salt/soc/merged.map.jinja

@@ -85,14 +85,8 @@
 {%   do SOCMERGED.config.server.update({'airgapEnabled': false}) %}
 {% endif %}
 
-{# Sigma correlations require ES|QL: load the community correlations and offer correlation authoring only when it is on #}
-{% set use_esql = SOCMERGED.config.server.modules.elastalertengine.useEsql %}
-{% for repo in SOCMERGED.config.server.modules.elastalertengine.rulesRepos %}
-{%   if repo.get('rulesetName') == 'securityonion-resources' and repo.get('folder') in ['sigma', 'sigma/stable'] %}
-{%     do repo.update({'folder': 'sigma' if use_esql else 'sigma/stable'}) %}
-{%   endif %}
-{% endfor %}
-{% if not use_esql %}
+{# Sigma correlations require ES|QL: offer correlation authoring only when it is on #}
+{% if not SOCMERGED.config.server.modules.elastalertengine.useEsql %}
 {%   do SOCMERGED.config.server.client.detection.templateDetections.pop('elastalert_correlation', None) %}
 {%   do SOCMERGED.config.server.client.detections.update({'queries': SOCMERGED.config.server.client.detections.queries | rejectattr('name', 'equalto', 'Detection Type - Sigma (Elastalert) - Correlations') | list}) %}
 {% endif %}