diff --git a/salt/nginx/config.sls b/salt/nginx/config.sls
index ac57d4ebad..27611034c2 100644
--- a/salt/nginx/config.sls
+++ b/salt/nginx/config.sls
@@ -49,6 +49,13 @@ navigatorconfig:
     - makedirs: True
     - template: jinja
 
+navigatorlayersdir:
+  file.directory:
+    - name: /opt/so/conf/navigator/layers/
+    - user: 939
+    - group: 939
+    - makedirs: True
+
 nginx_sbin:
   file.recurse:
     - name: /usr/sbin
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index eff21ccb97..a667d1f7a5 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -423,11 +423,11 @@ soc:
           intervalMinutes:
             description: How often to generate the Navigator Layers. (minutes)
             global: True
-            helpLink: navigator.html
+            helpLink: attack-navigator.html
           lookbackDays:
             description: How far back to search for ATT&CK-tagged alerts. (days)
             global: True
-            helpLink: navigator.html
+            helpLink: attack-navigator.html
       client:
         enableReverseLookup:
           description: Set to true to enable reverse DNS lookups for IP addresses in the SOC UI.