From cfb8992a92104c78cd8893f02840822a37a62f4e Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 15 Oct 2026 11:16:48 -0400
Subject: [PATCH] Add readonly attribute to earliest alert time field

---
 salt/soc/soc_soc.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index cd85b9ca6..0344c21c1 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -1063,6 +1063,7 @@ soc:
               regex: '^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z)?$'
               regexFailureMessage: Expecting date in RFC3339 format (2026-09-24T00:00:00Z)
               global: True
+              readonly: True
               advanced: True
           tools:
             filterEventFields: