Skip to content

ESQL: Support community_id and network_direction function #133943

@flash1293

Description

@flash1293

Description

Support the functionality from https://www.elastic.co/docs/reference/enrich-processor/community-id-processor and https://www.elastic.co/docs/reference/enrich-processor/network-direction-processor as part of ESQL as a function

The community_id function would take source ip, source port, destination ip, destination port, iana number, icmp type, icmp code, transport and seed as parameters and return the calculated community id

The network_direction function would take source ip, destination ip and a list of internal networks as parameters and return the direction similar to the processor.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions