The most common thing I have heard for notifying users about changes is the notification messages and the global banner. The messages are not my favorite method because they are often missed and if someone dismisses them, they are dismissed for everyone, so I encourage using a global banner.
If you are using the Web interface to do this, banners can be changed by going to the upper right settings - server controls - global banner.
This is probably all you need, but if you ever run into a situation that we had where we had standalone search heads geographically dispersed across the world, we needed a method to be able to change hundreds of search heads at one time, we used SOAR automation to do this. We would create a single dashboard that would send an alert to SOAR phantom and that would than trigger an alert that would go to SOAR and then SOAR would ssh into all of the boxes and issue the necessary changes. This was a really cool process, but I am assuming you don't have that problem and you can just go into the web interface of one Search Head and change your banner and you will be good.
Here is a video of using soar and ssh and curl to send messages.
https://youtu.be/gd5xDNGEsoU
I did not make a video of using SOAR and ssh and modifying the global-banner.conf file, but that is the file you would be looking to modify if you want to change banner notifications.
