Fixing Suricata configuration errors (although it did not stopped it …

…from running), and retrieving destination IP in more use cases than before
CybercentreCanada · Feb 10, 2025 · c84b5c1 · c84b5c1
1 parent 3c4052f
commit c84b5c1
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/suricata_/conf/suricata.yaml b/suricata_/conf/suricata.yaml
@@ -1927,8 +1927,8 @@ __RULE_FILES__
 ## Auxiliary configuration files.
 ##
 
-classification-file: /etc/suricata/classification.config
-reference-config-file: /etc/suricata/reference.config
+classification-file: /usr/local/etc/suricata/classification.config
+reference-config-file: /usr/local/etc/suricata/reference.config
 # threshold-file: /etc/suricata/threshold.config
 
 ##

diff --git a/suricata_/helper.py b/suricata_/helper.py
@@ -109,7 +109,7 @@ def attach_network_connection(data: dict):
 
         network_data = {
             "objectid": {
-                "tag": ext_hostname + f"{f':{dest_port}' if dest_port else ''}",
+                "tag": f"{dest_ip if dest_ip else ext_hostname}" + f"{f':{dest_port}' if dest_port else ''}",
                 "time_observed": timestamp,
             },
             "source_ip": src_ip,