diff --git a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env
index b054cf5..cf4c91c 100644
--- a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env
+++ b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env
@@ -1 +1 @@
-FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd dogtag barbican logrotate)
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd dogtag barbican logrotate auditd)
diff --git a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml
index 8a7241f..1db0cfa 100644
--- a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml
+++ b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml
@@ -8,6 +8,7 @@
 - system.openssh.server.team.mcp_qa
 - cluster.virtual-mcp-pike-dvr-ssl-barbican.infra
 - cluster.virtual-mcp-pike-dvr-ssl-barbican.openstack
+- system.auditd.server.ciscat
 - cluster.overrides
 parameters:
   _param: