Suricata

Be able to tie signatures to a specific interface in IPS mode. Suricata supports multi-tenancy and there could be a solution going down that path, but multi-tenancy is not currently supported for IPS.

I have a solution that implements an "origin" keyword that essentially adds a role to a live device, i.e. client, server, etc., then the origin keyword is used so that a signature only triggers if a flow originated from an interface with a specific role.

I will make a PR shortly with this keyword.