diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 6551b632b..d3a94691e 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -2,6 +2,36 @@ soc:
   enabled:
     description: You can enable or disable SOC.
     advanced: True
+  files:
+    soc:
+      banner__md:
+        title: Login Banner
+        description: Customize the login page with a specific markdown-formatted message.
+        file: True
+        global: True
+        syntax: md
+        helpLink: soc-customization.html
+      motd__md:
+        title: Overview Page
+        description: Customize the overview page with specific markdown-formatted content. Images can be used but must be hosted from another host that is accessible by the user's browser.
+        file: True
+        global: True
+        syntax: md
+        helpLink: soc-customization.html
+      custom__js:
+        title: Custom Javascript
+        description: Customize SOC UI behavior with custom Javascript code. Custom Javascript not provided by Security Onion Solutions is unsupported, and should be removed prior to requesting support and prior to performing upgrades.
+        file: True
+        global: True
+        advanced: True
+        helpLink: soc-customization.html
+      custom_roles:
+        title: Custom Roles
+        description: Customize role and permission mappings. Changing this setting requires a complete understanding of the SOC RBAC system.
+        file: True
+        global: True
+        advanced: True
+        helpLink: soc-customization.html
   config:
     licenseKey:
       title: License Key
@@ -12,36 +42,6 @@ soc:
       description: The SOC log level, useful for enabling debug logging for advanced troubleshooting. Allowed values are debug, info, warn, error. The SOC log is available at /opt/so/log/soc/sensoroni-server.log.
       global: True
       regex: ^(info|debug|warn|error)$
-    files:
-      soc:
-        banner__md:
-          title: Login Banner
-          description: Customize the login page with a specific markdown-formatted message.
-          file: True
-          global: True
-          syntax: md
-          helpLink: soc-customization.html
-        motd__md:
-          title: Overview Page
-          description: Customize the overview page with specific markdown-formatted content. Images can be used but must be hosted from another host that is accessible by the user's browser.
-          file: True
-          global: True
-          syntax: md
-          helpLink: soc-customization.html
-        custom__js:
-          title: Custom Javascript
-          description: Customize SOC UI behavior with custom Javascript code. Custom Javascript not provided by Security Onion Solutions is unsupported, and should be removed prior to requesting support and prior to performing upgrades.
-          file: True
-          global: True
-          advanced: True
-          helpLink: soc-customization.html
-        custom_roles:
-          title: Custom Roles
-          description: Customize role and permission mappings. Changing this setting requires a complete understanding of the SOC RBAC system.
-          file: True
-          global: True
-          advanced: True
-          helpLink: soc-customization.html
     actions:
       description: A list of actions a user can take from the SOC UI against a hunt, alert, and other records. The action must be defined in JSON object format, and contain a "name" key and "links" key. The links is a list of URLs, where the most suitable URL in the list will be the selected URL when the user clicks the action.
       global: True