Computes the Community ID, a standard for hashing network flows. This can be used to easily correlate and join network flows across systems.
This implements the
community_id_v1
functions as
described in the
Community
ID Spec. If the protocol is found to be ICMP, then
icmptype and icmpcode will be mapped to port equivalents as
described by the
community_id_icmp
function in the specification.
If this function receives invalid inputs (for example, an invalid IP or a port out of range), it will assign the empty string to the output field as.
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
as | string | optional[a] | _community_id | Name of the output field |
destinationip | string | required | Name of destination IP address field. The value must be an IPv4 or IPv6 address. | |
destinationport | integer | optional[a] | Name of the destination port field. If set, the destinationip parameter must also be set. | |
Minimum | 0 | |||
Maximum | 65535 | |||
icmpcode | integer | optional[a] | Name of the ICMP code field. If this parameter is set, then the icmptype parameter must also be set. | |
Minimum | 0 | |||
Maximum | 65535 | |||
icmptype | integer | optional[a] | Name of the ICMP type field. If this parameter is set, then the icmpcode parameter must also be set. | |
Minimum | 0 | |||
Maximum | 65535 | |||
proto | string | required | Name of protocol field. This field will be read directly and either interpreted directly as a IANA protocol number, or as the keyword of a protocol number from the Protocol Numbers. The value in the field must be either a protocol keyword or a number in the range 0 to 255. | |
seed | integer | optional[a] | 0 | The seed value used when computing the Community ID. |
Minimum | 0 | |||
Maximum | 65535 | |||
sourceip | string | required | Name of source IP address field. The value must be an IPv4 or IPv6 address. | |
sourceport | string | optional[a] | Name of the source port field. If set, the destinationip parameter must also be set. | |
Minimum | 0 | |||
Maximum | 65535 | |||
[a] Optional parameters use their default value unless explicitly set. |
communityId()
Examples
Click
next to an example below to get the full details.Compute Community ID
Computes the Community ID, a standard for hashing network flows
Query
communityId(proto=flow.protocolIdentifier,
sourceip=flow.sourceIPv4Address,
sourceport=flow.sourceTransportPort,
destinationip=flow.destinationIPv4Address,
destinationport=flow.destinationTransportPort)
Introduction
In this example, the communityId()
function
is used to calculate the Community IDs for netflow logs. To
generate the Community ID, a hash is performed with the source
and destination IP addresses and ports, along with the protocol
and a seed. By default the Community ID is outputted in a
_community_id field.
Step-by-Step
Starting with the source repository events.
- logscale
communityId(proto=flow.protocolIdentifier, sourceip=flow.sourceIPv4Address, sourceport=flow.sourceTransportPort, destinationip=flow.destinationIPv4Address, destinationport=flow.destinationTransportPort)
Calculates the Community IDs for netflow logs, and returns the results in a _community_id field. The value in the destinationip and sourceip field must be an IPv4 or IPv6 address. The Community ID values can be used for filtering.
Event Result set.
Summary and Results
The query is used to compute the Community ID, a network flow hash standard. The query generates a consistent hash for each unique network flow, allowing for easy tracking and correlation. This can be used to easily correlate and join network flows across systems. The flow hash is useful for correlating all network events related to a single flow.