use suricata socket about dalton HOT 4 CLOSED

Thanks zoomequipd. This idea has been kicked around a few times over the years but never implemented. I think it has merit and I like the ruleset hash method; you'd have to include the config and variables in the hash too.

What's your use case? Just faster times for manually submitted jobs? Or are you programmatically submitting "1000 pcaps" as individual jobs? If the latter, a related feature could be to have an option in the interface to tell Dalton to treat each pcap as separate job and then you could submit a tgz or zip with multiple pcaps.

from dalton.

My use case is programmatically submitting thousands of pcaps - a feature to split out pcaps from a archive file would be awesome. I wonder though how it'd be possible to tie the results back to the original pcap.

from dalton.

This is definately on the to-do list to explore although it doesn't have top priority at the moment.

The immediately available solution for quickly processing thousands of jobs is to spin up dozens, hundreds, or more Dalton Agent containers (and you can use the same image).

from dalton.

Implemented, thanks! -- #133

from dalton.