Configurable Sensor_ID in Unified2 Output
Make the "Sensor ID" field of the Unified2 output format capable of being set via configuration file. In environments where there are many sensors logging to a central logging device (i.e. enterprise deployment, SIEM logging, etc.) in Unified2 format, this would make it easier to distinguish what sensor an alert came from.
Based on section 5.3.8 of http://manual.snort.org/node44.html, the “Sensor ID” field in Unified2 alerts is completely unused. It appears that Suricata hardcodes this value to zero from looking at alert-unified2-alert.c (line 361).