From 55e984df4cb3ba3dc9023a47d969895d9b0b5555 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <josh@defensivedepth.com>
Date: Thu, 26 Feb 2026 10:12:23 -0500
Subject: [PATCH] readonly deprecated setting

---
 salt/soc/soc_soc.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index c9714d3ff..596ba4bd0 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -557,10 +557,11 @@ soc:
             global: True
             advanced: True
           customRulesets:
-            description: 'URLs and/or Local File configurations for Suricata custom rulesets. Refer to the linked documentation for important specification and file placement information'
+            description: 'This setting is no longer used. Use Ruleset Sources setting instead.'
             global: True
             advanced: True
             forcedType: "[]{}"
+            readonly: True
             helpLink: suricata.html
           ignoredSidRanges:
             description: 'List of Suricata SID ranges to ignore during the Integrity Check. This is useful for ignoring specific rules not governed by the UI. Each line should contain 1 range in the format "1100000-1200000". The ranges are treated as inclusive.'