Can't seem to get "!include" working

Help
,
2

You should try to move the af-packet: part into the interfaces.yaml and include this as a whole.

So for example in the suricata.yaml in the end:

# include af-packet section
include: interfaces.yaml

and the interfaces.yaml looks like:

%YAML 1.1
---

af-packet:
- interface: enp0s3
  cluster-id: 99
  threads: auto
1 Like