This is a really good question and hopefully I can help you out here. In search, we have the concept of grouped fields. When we search for IP = 1.1.1.1 for example, we end up searching a number of different IP fields including principal, target, observer, etc...
This group function would be similar to that except that it puts the power in your hands to choose which of those fields you want grouped together. So perhaps rather than wanting the observer and intermediary ip in my search I could just search on principal and target, like this:
$ip = group(principal.ip, target.ip)
Let's apply this to statistical search. Our first example is just matching on target IP and calculating an event count and sum of bytes. We get 58,053 events for the target IP 10.128.0.21
metadata.vendor_name = "Corelight" AND metadata.product_event_type = "conn" AND metadata.event_type = "NETWORK_CONNECTION"
$tip = target.ip
match:
$tip
outcome:
$event_count = count_distinct(metadata.id)
$sent_bytes = sum(network.sent_bytes)
$received_bytes = sum(network.received_bytes)
order:
$event_count desc
limit:
5
Same search except we are grouping on principal IP. Here we have 28,724 events for the principal IP 10.128.0.21
metadata.vendor_name = "Corelight" AND metadata.product_event_type = "conn" AND metadata.event_type = "NETWORK_CONNECTION"
$pip = principal.ip
match:
$pip
outcome:
$event_count = count_distinct(metadata.id)
$sent_bytes = sum(network.sent_bytes)
$received_bytes = sum(network.received_bytes)
order:
$event_count desc
limit:
5
If we chose to group these two values together, we could do that and generate a set of calculated fields for that singular IP without caring if that IP is serving as the principal or target. When we do this, we get an event count of 86,777 for 10.128.0.21 which is the sum of the event counts from the two searches above.
metadata.vendor_name = "Corelight" AND metadata.product_event_type = "conn" AND metadata.event_type = "NETWORK_CONNECTION"
$ip = group(principal.ip, target.ip)
match:
$ip
outcome:
$event_count = count_distinct(metadata.id)
$sent_bytes = sum(network.sent_bytes)
$received_bytes = sum(network.received_bytes)
order:
$event_count desc
limit:
5
If we wanted to match on both fields, we could, but the results are going to be a bit different because we are counting and summing by the combination of principal and target pairs.
metadata.vendor_name = "Corelight" AND metadata.product_event_type = "conn" AND metadata.event_type = "NETWORK_CONNECTION"
$tip = target.ip
$pip = principal.ip
match:
$tip, $pip
outcome:
$event_count = count_distinct(metadata.id)
$sent_bytes = sum(network.sent_bytes)
$received_bytes = sum(network.received_bytes)
order:
$event_count desc
limit:
5
Fiinally, if you wanted to concatenate the principal and target into a placeholder variable and then aggregating on that and calculating values, you could as well. Notice that while the presentation of the IP addresses is a bit off the calculations are the same and the match by both the principal and target ip.
metadata.vendor_name = "Corelight" AND metadata.product_event_type = "conn" AND metadata.event_type = "NETWORK_CONNECTION"
$ip = strings.concat(principal.ip, " / ", target.ip)
match:
$ip
outcome:
$event_count = count_distinct(metadata.id)
$sent_bytes = sum(network.sent_bytes)
$received_bytes = sum(network.received_bytes)
order:
$event_count desc
limit:
5
Hope this helps!
