Merge pull request #12756 from Security-Onion-Solutions/2.4/detection…

…s-defaults

Use list not string

salt/soc/merged.map.jinja

@@ -32,7 +32,7 @@
 
 {# do not automatically enable Sigma rules if install is Eval or Import #}
 {% if grains['role'] in ['so-eval', 'so-import'] %}
-  {%   do SOCMERGED.config.server.modules.elastalertengine.update({'autoEnabledSigmaRules': ""}) %}
+  {%   do SOCMERGED.config.server.modules.elastalertengine.update({'autoEnabledSigmaRules': []}) %}
 {% endif %}
 
 {# remove these modules if detections is disabled #}