From ffaab4a1b47d7949ab6ff061d97d0b59f95ad049 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 6 Sep 2023 14:19:53 -0400
Subject: [PATCH] only add endgame to action if it is populated

---
 salt/soc/merged.map.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
index dc2f889bb..c17c23b25 100644
--- a/salt/soc/merged.map.jinja
+++ b/salt/soc/merged.map.jinja
@@ -35,7 +35,7 @@
 {% endif %}
 
 {% set standard_actions = SOCMERGED.config.pop('actions') %}
-{% if pillar.global.endgamehost is defined %}
+{% if pillar.global.endgamehost != '' %}
 {%   set endgame_dict = {
        "name": "Endgame",
        "description": "Endgame Endpoint Investigation and Response",