FIX: Adjust so-import-pcap so that suricata works when it is pcapengine

[dougburks]

When pcapengine is SURICATA or TRANSITION, suricata is configured to write full packet capture. When running so-import-pcap, suricata then fails because suricata.yaml specifies a pcap directory that is not specified in the docker volume mappings in so-import-pcap. For so-import-pcap, we don't really need suricata to write full packet capture so we can specify the mapping as /dev/null.

[dougburks]

Tested and verified that so-import-pcap ran successfully and Suricata alerts appeared in Dashboards with pcapengine set to suricata:

sudo so-import-pcap 2024-04-18-SSLoad-with-follow-up-Cobalt-Strike-DLL.pcap 
[sudo] password for doug: 
Processing Import: /home/doug/2024-04-18-SSLoad-with-follow-up-Cobalt-Strike-DLL.pcap
- verifying file
- assigning unique identifier to import: 8983316502fda7a97914a6f466fc6e84
- analyzing traffic with Suricata
- analyzing traffic with Zeek
- found PCAP data spanning dates 2024-04-18 through 2024-04-18

Import complete!

Use the following hyperlink to view the imported data. Triple-click to quickly highlight the entire hyperlink and then copy it into a browser:
https://standalone.hq.acmeonions.com/#/dashboards?q=import.id:8983316502fda7a97914a6f466fc6e84%20%7C%20groupby%20-sankey%20event.dataset%20event.category%2a%20%7C%20groupby%20-pie%20event.category%20%7C%20groupby%20-bar%20event.module%20%7C%20groupby%20event.dataset%20%7C%20groupby%20event.module%20%7C%20groupby%20event.category%20%7C%20groupby%20observer.name%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port&t=2024%2F04%2F18%2000%3A00%3A00%20AM%20-%202024%2F04%2F19%2000%3A00%3A00%20AM&z=UTC

or, manually set the Time Range to be (in UTC):
From: 2024-04-18    To: 2024-04-19

Note: It can take 30 seconds or more for events to appear in Security Onion Console.

Tested and verified with pcapengine set to steno:

sudo so-import-pcap 2024-01-23-UltraVNC-infection-traffic.pcap 
Processing Import: /home/doug/2024-01-23-UltraVNC-infection-traffic.pcap
- verifying file
- assigning unique identifier to import: ef54b7158eb0517dcdac67c37fa7bb0a
- analyzing traffic with Suricata
- analyzing traffic with Zeek
- found PCAP data spanning dates 2024-01-23 through 2024-01-24

Import complete!

Use the following hyperlink to view the imported data. Triple-click to quickly highlight the entire hyperlink and then copy it into a browser:
https://standalone.hq.acmeonions.com/#/dashboards?q=import.id:ef54b7158eb0517dcdac67c37fa7bb0a%20%7C%20groupby%20-sankey%20event.dataset%20event.category%2a%20%7C%20groupby%20-pie%20event.category%20%7C%20groupby%20-bar%20event.module%20%7C%20groupby%20event.dataset%20%7C%20groupby%20event.module%20%7C%20groupby%20event.category%20%7C%20groupby%20observer.name%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port&t=2024%2F01%2F23%2000%3A00%3A00%20AM%20-%202024%2F01%2F25%2000%3A00%3A00%20AM&z=UTC

or, manually set the Time Range to be (in UTC):
From: 2024-01-23    To: 2024-01-25

Note: It can take 30 seconds or more for events to appear in Security Onion Console.