suricata: use session to store duration preference