From e2bf2837fea1e78232f6b5528345c3b604fd2394 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 22 Sep 2026 08:18:59 -0400
Subject: [PATCH] notification annotations

---
 salt/soc/defaults.yaml | 3 +++
 salt/soc/soc_soc.yaml  | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index f1f5e8f25..763768d72 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1494,6 +1494,9 @@ soc:
           org: Security Onion
           bucket: telegraf/so_short_term
           verifyCert: false
+        notification:
+          dismissedPruneDays: 30
+          enabled: false
         playbook:
           autoUpdateEnabled: true
           playbookImportFrequencySeconds: 86400
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 2713efb73..1629d358f 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -498,6 +498,15 @@ soc:
             forcedType: string
             syntax: json
             storage: db
+          dismissedPruneDays:
+            title: Dismissed Retention Days
+            description: The number of days to retain dismissed notifications. When a notification is dismissed, it will be pruned after this many days. Only one user need dismiss a notification for it to be pruned.            global: True
+            forcedType: int
+            global: True
+          enabled:
+            description: Enables or disables the SOC notification module.
+            forcedType: bool
+            global: True
         postgres:
           host:
             description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.