From 1d3bae4a7acbf10a90074c5a382a52d3fc0dfd78 Mon Sep 17 00:00:00 2001
From: Mike Reeves <reevesmk@gmail.com>
Date: Thu, 27 Feb 2025 11:15:51 -0500
Subject: [PATCH] Add additional entries for actions

---
 salt/soc/soc_soc.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 73ed72f2a..d8a00bbfd 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -81,7 +81,8 @@ soc:
         label: Target (_blank, _self, mynewtab)
       - field: categories
         label: Categories
-        multiline: True        
+        multiline: True  
+        forcedType: "[]string"      
     eventFields:
       default: &eventFields
         description: Event fields mappings are defined by the format ":event.module:event.dataset". For example, to customize which fields show for 'syslog' events originating from 'zeek', find the eventField item in the left panel that looks like ':zeek:syslog'. The 'default' entry is used for all events that do not match an existing mapping defined in the list to the left.