Czech QOL changes

[liskaant]

Here are a few QOL changes from the Czech ECSC Team. Specifically:

• Tagging HTTP traffic
• Fix some HTTP parsing logic errors
• Restarting docker containers on fail
• Enricher keeps looking for eve.json instead of dying
• PCAP_OVER_IP env variable

Thanks for open-sourcing Tulip. Love from Team Czenk :heart:

[meme-lord]

You should use restart: unless-stopped instead of restart: on-failure in docker-compose. Some services can exit with code 0 and on-failure won't restart them in that case. For example if you use PCAP-Over-IP and stop the tcpdump process the assembler service will exit with code 0 and not start again.

[liskaant]

You should use restart: unless-stopped instead of restart: on-failure in docker-compose ...

Good point, changed