diff --git a/salt/kibana/defaults.yaml b/salt/kibana/defaults.yaml
index 49df34a9b..62ee380f3 100644
--- a/salt/kibana/defaults.yaml
+++ b/salt/kibana/defaults.yaml
@@ -9,6 +9,17 @@ kibana:
       timeDefaults:
         from: now-24h
         to: now
+    securitySolution:
+      defaultIndex:
+        - apm-*-transaction*
+        - traces-apm*
+        - auditbeat-*
+        - endgame-*
+        - filebeat-*
+        - logs-*
+        - packetbeat-*
+        - winlogbeat-*
+        - so-*
   config:
     server:
       name: kibana
diff --git a/salt/kibana/files/saved_objects.ndjson.jinja b/salt/kibana/files/saved_objects.ndjson.jinja
index 839035e47..d67b01b50 100644
--- a/salt/kibana/files/saved_objects.ndjson.jinja
+++ b/salt/kibana/files/saved_objects.ndjson.jinja
@@ -1,4 +1,22 @@
-{"attributes":{"buildNum":39457,"defaultIndex":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29","defaultRoute":"/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645","discover:sampleSize":{{SAVED_OBJECTS.discover.get('sampleSize', 100)}},"theme:darkMode":{{SAVED_OBJECTS.theme.get('darkMode', True) | string | lower }},"timepicker:timeDefaults":"{\n  \"from\": \"{{SAVED_OBJECTS.timepicker.timeDefaults.get('from', 'now-24h')}}\",\n  \"to\": \"{{SAVED_OBJECTS.timepicker.timeDefaults.get('to', 'now')}}\"\n}"},"securitySolution:defaultIndex":["apm-*-transaction*","traces-apm*","auditbeat-*","endgame-*","filebeat-*","logs-*","packetbeat-*","winlogbeat-*","so-*"],"coreMigrationVersion":"7.15.0","id":"7.15.0","migrationVersion":{"config":"7.13.0"},"references":[],"sort":[1633625537804,2310],"type":"config","updated_at":"2021-10-07T16:52:17.804Z","version":"Wzg1NDE3LDVd"}
+{
+  "attributes": {
+    "buildNum":39457,
+    "defaultIndex":"2289a0c0-6970-11ea-a0cd-ffa0f6a1bc29",
+    "defaultRoute":"/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645",
+    "discover:sampleSize":{{ SAVED_OBJECTS.discover.get('sampleSize', 100) }},
+    "theme:darkMode":{{ SAVED_OBJECTS.theme.get('darkMode', True) | string | lower }},
+    "timepicker:timeDefaults":"{\n  \"from\": \"{{ SAVED_OBJECTS.timepicker.timeDefaults.get('from', 'now-24h') }}\",\n  \"to\": \"{{ SAVED_OBJECTS.timepicker.timeDefaults.get('to', 'now') }}\"\n}"
+  },
+    "securitySolution:defaultIndex": {{ SAVED_OBJECTS.securitySolution.defaultIndex }},
+    "coreMigrationVersion":"7.15.0",
+    "id":"7.15.0",
+    "migrationVersion":{"config":"7.13.0"},
+    "references":[],
+    "sort":[1633625537804,2310],
+    "type":"config",
+    "updated_at":"2021-10-07T16:52:17.804Z",
+    "version":"Wzg1NDE3LDVd"
+}
 
 {% raw -%}
 {"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security Onion - Network Data","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security Onion - Network Data\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"[Home](/kibana/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645)     \\n \\n**Datasets**    \\n[Connections](/kibana/app/dashboards#/view/0cc628b0-6e9f-11ea-9266-1fd14ca6af34) |  [DCE/RPC](/kibana/app/dashboards#/view/9e882df0-72c5-11ea-8dd2-9d8795a1200b) |\\n[DHCP](/kibana/app/dashboards#/view/80625c10-96dd-11ea-814e-bb515e873c2c)    \\n[DNP3](/kibana/app/dashboards#/view/b1f52180-755a-11ea-9565-7315f4ee5cac)  |  [DNS](/kibana/app/dashboards#/view/55ac6bf0-6ec4-11ea-9266-1fd14ca6af34) |\\n[FTP](/kibana/app/dashboards#/view/739bfad0-755a-11ea-9565-7315f4ee5cac) |\\n[HTTP](/kibana/app/dashboards#/view/44e9c820-6eb1-11ea-9266-1fd14ca6af34) | [Intel](/kibana/app/dashboards#/view/85b529a0-0e5a-11eb-a255-e1e8e85e3571) | [IRC](/kibana/app/dashboards#/view/38523560-75ba-11ea-9565-7315f4ee5cac)  |\\n[Kerberos](/kibana/app/dashboards#/view/b207ab90-75bc-11ea-9565-7315f4ee5cac)   \\n[Modbus](/kibana/app/dashboards#/view/886a7b90-75bd-11ea-9565-7315f4ee5cac) | \\n[MySQL](/kibana/app/dashboards#/view/c3ced6d0-75be-11ea-9565-7315f4ee5cac)  | \\n[NTLM](/kibana/app/dashboards#/view/558292e0-75c1-11ea-9565-7315f4ee5cac)  | \\n[PE](/kibana/app/dashboards#/view/94b55b90-c761-11ea-bebb-37c5ab5894ea) |\\n[RADIUS](/kibana/app/dashboards#/view/b9769e60-75c4-11ea-9565-7315f4ee5cac) | [RDP](/kibana/app/dashboards#/view/5b743150-75c5-11ea-9565-7315f4ee5cac) | \\n[RFB](/kibana/app/dashboards#/view/c8b3c360-75c6-11ea-9565-7315f4ee5cac) | [SIP](/kibana/app/dashboards#/view/dd98e260-75c6-11ea-9565-7315f4ee5cac)     \\n[SMB](/kibana/app/dashboards#/view/f24d7b80-75c6-11ea-9565-7315f4ee5cac) | [SMTP](/kibana/app/dashboards#/view/00304500-75e7-11ea-9565-7315f4ee5cac) | [SNMP](/kibana/app/dashboards#/view/96522610-75e8-11ea-9565-7315f4ee5cac) | \\n[SSH](/kibana/app/dashboards#/view/9dfd77e0-75eb-11ea-9565-7315f4ee5cac) | [SSL](/kibana/app/dashboards#/view/efae8de0-75eb-11ea-9565-7315f4ee5cac) | [Syslog](/kibana/app/dashboards#/view/66499a20-75ed-11ea-9565-7315f4ee5cac) | [Tunnels](/kibana/app/dashboards#/view/c962dd60-75ed-11ea-9565-7315f4ee5cac) | [X.509](/kibana/app/dashboards#/view/2e0865f0-75ee-11ea-9565-7315f4ee5cac)   \\n\"}}"},"id":"7f822930-6ea4-11ea-9266-1fd14ca6af34","migrationVersion":{"visualization":"7.11.0"},"references":[],"type":"visualization","updated_at":"2021-03-19T14:35:12.119Z","version":"WzY5Njg2LDRd"}