From bce6b0c1fe6ad7f307d388e3d66d659b7fbede3b Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Mon, 31 Aug 2026 16:11:29 -0600
Subject: [PATCH] Allow Timestamp in dontScanBefore

Now storing UTC timestamp in the dontScanBefore field.
---
 salt/soc/soc_soc.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index b4f01d541..2710ab179 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -855,8 +855,8 @@ soc:
             forcedType: bool
           dontScanBefore:
             description: A date specifying how far back to scan for memories. Must be in YYYY-MM-DD format.
-            regex: "^(\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\d|3[01])|(0[469]|11)-(0[1-9]|[12]\d|30)|02-(0[1-9]|[12]\d)))?$"
-            regexFailureMessage: Expecting date in YYYY-MM-DD format
+            regex: "^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$"
+            regexFailureMessage: Expecting date in RFC3339 format (2026-08-31T22:05:48Z)
             global: True
             advanced: True
           memoryScanIntervalSeconds: