Skip to main content

Community ID

Security Networking

Synopsis​

Computes the Community ID for network flow data, as defined in the Community ID Specification.

Schema​

- community_id:
    description: <text>
    destination_ip: <ident>
    destination_port: <ident>
    iana_number: <ident>
    icmp_code: <ident>
    icmp_type: <ident>
    if: <script>
    ignore_missing: <boolean>
    ignore_failure: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    source_ip: <ident>
    source_port: <ident>
    seed: <numeric>
    tag: <string>
    target_field: <ident>
    transport: <ident>

Configuration​

The following fields are used to define the processor:

FieldRequiredDefaultDescription
descriptionN-Explanatory text
destination_ipNdestination.ipField containing the destination IP
destination_portNdestination.portField containing the destination port
iana_numberNnetwork.iana_numberField containing the IANA number
icmp_codeNicmp.codeField containing the ICMP code
icmp_typeNicmp.typeField containing the ICMP type
ifN-Condition to run
ignore_missingNfalseHas no effect here. A missing source or destination IP already ends the processor quietly, so the condition this flag guards never arises
ignore_failureNfalseSee Handling Failures
on_failureN-See Handling Failures
on_successN-See Handling Success
source_ipNsource.ipField containing the source IP
source_portNsource.portField containing the source port
seedN0Seed for the hash to be generated for the ID. Must be in the 0..65535 range. Can prevent hash collisions between network domains that use the same scheme
tagN-Identifier
disabledNfalseWhen true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
target_fieldNnetwork.community_idField for the output
transportNnetwork.transportField containing the transport protocol name. Used only when iana_number is not defined. Recognised names, matched case-insensitively: eigrp, gre, icmp, icmpv6, igmp, ospf, pim, sctp, tcp, udp. Anything else fails the processor

Details​

Use to correlate network events related to a single flow. By default, reads network flow data from the related ECS fields.

The value is the version prefix 1: followed by the base64-encoded SHA-1 of the flow tuple — for example 1:r8mCJwk816h4w3LQgwfmuIxcofc=. Consumers that compare Community IDs across tools must keep the prefix.

The hash is direction-independent: the tuple is ordered canonically before hashing, so a packet and its reply produce the same ID.

The protocol is taken from iana_number when that field is present; transport is consulted only otherwise. For ICMP and ICMPv6 (1 and 58) the type and code stand in for the ports, again resolved so that a request and its reply agree.

A missing or empty source or destination IP ends the processor quietly with no output field. A missing protocol — neither iana_number nor transport present — is an error.

Examples​

A TCP flow with both endpoints and the transport name:

{
  "source": {
    "ip": "192.168.1.10",
    "port": 54321
  },
  "destination": {
    "ip": "10.0.0.5",
    "port": 443
  },
  "network": {
    "transport": "TCP"
  }
}

computing its Community ID...

- community_id:
    source_ip: source.ip
    target_field: network.community_id

giving the flow identifier, version prefix included:

{
  "source": {
    "ip": "192.168.1.10",
    "port": 54321
  },
  "destination": {
    "ip": "10.0.0.5",
    "port": 443
  },
  "network": {
    "community_id": "1:r8mCJwk816h4w3LQgwfmuIxcofc=",
    "transport": "TCP"
  }
}