Merge pull request #11000 from Security-Onion-Solutions/issue/10954

Issue/10954

salt/suricata/map.jinja

@@ -11,7 +11,7 @@
 {# suricata.config.af-packet has to be rewritten here since we cant display '- interface' in the ui #}
 {# we are limited to only one iterface #}
 {% load_yaml as afpacket %}
-- interface: {{ SURICATAMERGED.config['af-packet'].interface }}
+- interface: {{ GLOBALS.sensor.interface }}
   cluster-id: {{ SURICATAMERGED.config['af-packet']['cluster-id'] }}
   cluster-type: {{ SURICATAMERGED.config['af-packet']['cluster-type'] }}
   defrag: {{ SURICATAMERGED.config['af-packet'].defrag }}

salt/suricata/soc_suricata.yaml

@@ -14,7 +14,9 @@ suricata:
   config:
     af-packet:
       interface:
-        description: The network interface that Suricata will monitor.
+        description: The network interface that Suricata will monitor. This is set under sensor > interface.
+        advanced: True
+        readonly: True
         helpLink: suricata.html
       cluster-id:
         advanced: True