poc3

Dockerfile

@@ -70,6 +70,11 @@ ENV PYTHONUNBUFFERED=1 \
     DB_PATH=/data/ids.db \
     EVE_PATH=/data/logs/suricata/eve.json \
     SURICATA_LOG_MAX_MB=512 \
+    FORENSIC_PCAP_MODE=blocks \
+    FORENSIC_PCAP_WINDOW_SECONDS=60 \
+    FORENSIC_PCAP_MEMORY_MB=64 \
+    FORENSIC_PCAP_MAX_FILES=32 \
+    FORENSIC_PCAP_MAX_TOTAL_MB=512 \
     SURICATA_OUTPUT_CONFIG=/opt/ids/suricata/ids-output.yaml \
     SURICATA_LOCAL_RULES=/data/suricata/local.rules \
     SURICATA_EXTRA_RULES_GLOB=/data/suricata/*.rules \