add different tags for PCAP import and Monitoring port

[nebra-status]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

48

RAM

256

Storage for /

300GB

Storage for /nsm

13TB

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi there,

we're currently running a system that is both monitoring realtime traffic and where pcaps from another network must be imported with so-import-pcap.
As these are 2 different networks, I'd like to add a tag "pcap-import" to the data from the PCAPs during the import.
Is there some smart way to do this with the logstash pipeline?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[Anelka3523]

I have also same problem. There is a filename123.xml for each filename123.pcap file coming from different networks. I want to add the columns in this xml. thanks

[TOoSmOotH]

Do the IP ranges overlap or something?

[nebra-status]

Yes, local IP addresses overlap

[dougburks]

By default, imported data should already have a few different ways of differentiating it from live data.

data_stream.dataset:"import" 

event.imported:"true" 

_exists_:import.file

_exists_:import.id