From bb57545d083cd071cfbd5c4589813cc32843dfb9 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Thu, 17 Sep 2026 15:32:21 -0400
Subject: [PATCH 1/2] new annotations for notifications

---
 salt/soc/soc_soc.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 995d97493..0e9752e17 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -155,6 +155,13 @@ soc:
         description: Path to custom markdown templates for PDF report generation. All markdown files in this directory will be available as custom reports in the SOC Reports interface.
         global: True
         advanced: True
+      schedules:
+        title: Schedules
+        description: Schedules that are shared across the Security Onion product. Modify via one of the SOC Schedules view.
+        readonlyUi: True
+        global: True
+        forcedType: string
+        syntax: jason
       subgrids:
         title: Subordinate Grids
         description: |
@@ -476,6 +483,14 @@ soc:
             global: True
             advanced: True
             forcedType: bool
+        notification:
+          destinations:
+            title: Notification Destinations
+            description: JSON list of notifications. Modify via the SOC Notifications view.
+            readonlyUi: True
+            global: True
+            forcedType: string
+            syntax: jason
         postgres:
           host:
             description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.

From ecc643cd33d97d03f0735b4023aff6866d6f928c Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Thu, 17 Sep 2026 15:34:29 -0400
Subject: [PATCH 2/2] fix typo

---
 salt/soc/soc_soc.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 96e2b932f..294f7e4bc 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -161,7 +161,7 @@ soc:
         readonlyUi: True
         global: True
         forcedType: string
-        syntax: jason
+        syntax: json
       subgrids:
         title: Subordinate Grids
         description: |
@@ -495,7 +495,7 @@ soc:
             readonlyUi: True
             global: True
             forcedType: string
-            syntax: jason
+            syntax: json
         postgres:
           host:
             description: Hostname or IP address of the PostgreSQL server used by SOC. Defaults to the manager hostname.