From 1dc88781f160fb4526a53cdc8537a725aaa83017 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 22 Nov 2023 10:11:34 -0500
Subject: [PATCH] suricata interface None if so-import

---
 salt/suricata/afpacket.map.jinja | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/salt/suricata/afpacket.map.jinja b/salt/suricata/afpacket.map.jinja
index a6c390abb..7f2f121ab 100644
--- a/salt/suricata/afpacket.map.jinja
+++ b/salt/suricata/afpacket.map.jinja
@@ -1,6 +1,6 @@
 {% load_yaml as afpacket %}
 af-packet:
-  - interface: {{ salt['pillar.get']('sensor:interface', 'bond0') }}
+  - interface: {{ None if grains.role == 'so-import' else salt['pillar.get']('sensor:interface', 'bond0') }}
     cluster-id: 59
     cluster-type: cluster_flow
     defrag: yes
@@ -8,8 +8,4 @@ af-packet:
     threads: {{ salt['pillar.get']('sensor:suriprocs', salt['pillar.get']('sensor:suripins') | length) }}
     tpacket-v3: yes
     ring-size: {{ salt['pillar.get']('sensor:suriringsize', '5000') }}
-  - interface: default
-    #threads: auto
-    #use-mmap: no
-    #tpacket-v3: yes
 {% endload %}