Inconsistent Variable Naming - Track by Source IP

[wrharding]

Tracking by source IP is inconsistent across Sagan:

getting a source ip without normalization: parse_src_ip
https://sagan.readthedocs.io/en/latest/rule-keywords.html#parse-src-ip

normalization rules utilize the tag src-ip
https://github.com/quadrantsec/sagan-rules/blob/main/normalization.rulebase

xbits uses ip_src
https://sagan.readthedocs.io/en/latest/rule-keywords.html#xbits

flexbits uses by_src
https://sagan.readthedocs.io/en/latest/rule-keywords.html#flexbits

mapping from json uses src_ip
https://sagan.readthedocs.io/en/latest/rule-keywords.html#json-map

Sagan will utilize the following syntax to denote a source IP:
"src_ip": "10.200.2.82"

Having consistency around all of these would be ideal, but is certainly not a critical task.

[quadrantsec]

Agreed. I think i started my own direction and then switch when we became a Suricata shop.