Ted Dorosheff
01/28/2022, 7:26 PMSELECT *, community_id_v1(local_address, remote_address, local_port, remote_port, protocol) AS community_id FROM process_open_sockets JOIN processes ON process_open_sockets.pid = processes.pid;
this joins the table process_open_sockets (from which the community_id is generated and which has a PID) with the processes table ON the PID. This is what associates the community_id with the traffic's parent process and more valuably the processes command-line string.