Community ID

Mutate Elastic Compatible

Synopsis

Computes the Community ID for network flow data, as defined in the Community ID Specification.

Schema

community_id:
  - description: <text>
  - destination_ip: <string>
  - destination_port: <string>
  - iana_number: <numeric>
  - icmp_code: <numeric>
  - icmp_type: <enum>
  - if: <script>
  - ignore_missing: <boolean>
  - ignore_failure: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - source_ip: <string>
  - source_port: <numeric>
  - seed: <numeric>
  - tag: <string>
  - target_field: <ident>
  - transport: <enum>

Configuration

Field	Required	Default	Description
description	N	-	Explanatory text
destination_ip	N	destination.ip	Field containing the destination IP
destination_port	N	destionation.port	Field containing the destination port
iana_number	N	network.iana_number	Field containing the IANA number
icmp_code	N	icmp.code	Field containing the ICMP code
icmp_type	N	icmp.type	Field containing the ICMP
if	N	-	Condition to run
ignore_missing	N	true	If true and field does not exist, exit quietly without making any modifications
ignore_failure	N	false	See Handling Failures
on_failure	N	false	See Handling Failures
on_success	N	-	See Handling Success
source_ip	N	source.ip	Field containing the source IP
source_port	N	source.port	Field containing the source port
seed	N	0	Seed for the hash to be generated for the ID. Must be in the 0..65535 range. Can prevent hash collisions between network domains that use the same scheme
tag	N	-	Identifier
target_field	N	network.community_id	Field for the output
transport	N	network.transport	Field containing the transport protocol name or number. Used only when iana_number is not defined. Valid options: EIGRP, GRE, ICMP, ICMP IPv6, IGMP, OSPF, PIM, SCTP, TCP, and UDP

Details

Use to correlate network events related to a single flow. By default, reads network flow data from related ECS.

Examples

We have incoming and outgoing ip addresses and a port number:	{ "source": { "ip": "<ip-address-1>", "port": "<port-number-1>" }, "destination": { "ip": "<ip-address-2>", "port": "<port-number-2>" }, "network": { "transport": "TCP" } }
We want to figure out the user's community_id...	- community_id: field: source.ip target_field: network.community_id
which is a base64 hash value:	{ "source": { "ip": "<ip-address-1>", "port": "<port-number-1>" }, "destination": { "ip": "<ip-address-2>", "port": "<port-number-2>" }, "network": { "community_id": "<base64-hash>", "transport": "TCP" } }