inliniac/suricata — pull request #111 by owlsec (2012-10-02 10:35:29+00:00)
Title: Adds X-Forwarded-For support for the unified2 output.

It supports both the usage of the unified2 extra headers (like snort) and the IP replacement in the alert (so that the internal IP of the reverse proxy is replaced by the actual client IP taken from the XFF header).

The suricata.yaml configuration supports the usage of xff, xffheadername and xffoverwrite under the unified2-alert section in order to configure the mode of operation.

Example:

- unified2-alert:
enabled: yes
filename: unified2.alert
xff: yes
xffheadername: X-Forwarded-For
xffoverwrite: yes

xffoverwrite specifies the mode of operation. If it is set to yes, the alert IP address will be overwritten by the IP taken from the XFF header of the request which triggered the alert.