From 332a5d11bc643633bea768a657b7beaa12cb7ee2 Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Wed, 2 Sep 2026 09:08:46 -0600
Subject: [PATCH] Fix Regex

Double quoted stings in yaml allow for escape sequences like `\n` and `\t` but when used around a regex, salt will hang up on `\d` not being a valid escape sequence. Switching to single quotes so escapes aren't processed.
---
 salt/soc/soc_soc.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 1471056bd..53dedb4e3 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -855,7 +855,7 @@ soc:
             forcedType: bool
           dontScanBefore:
             description: A date specifying how far back to scan for memories. Must be in UTC format (2026-08-31T22:05:48Z).
-            regex: "^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$"
+            regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'
             regexFailureMessage: Expecting date in RFC3339 format (2026-08-31T22:05:48Z)
             global: True
             advanced: True