Hey all, had asked a question earlier in a DM about

community_id

, but have since figured it out on my own. Regardless, i'll share what i've learned because this is a really cool feature in osquery. so

community_id

for those who dont know, is a feature in osquery in which a hash of network flow attributes can be generated and assigned to the corresponding process responsible for the traffic. Think of it like a hash to uniquely identify a process and its corresponding network traffic. The part that i couldn't figure out, is how to generate the hash via a query. But i figured it out.

select *, community_id_v1(local_address, remote_address, local_port, remote_port, protocol) as community_id FROM process_open_sockets;