confluentinc / confluentinc/kafka-tutorials

Cybersecurity: Analyze Packbeat flows

Open
#1,066 0 comments 0 reactions 0 assignees View on GitHub
ksqlDB recipe use case
Dominant language
Java
Stars
39
Forks
91
PR merge metrics
No merged PRs in 30d

Description

Reference: https://maciejszymczyk.medium.com/ksqldb-real-time-sql-magic-in-the-cybersecurity-scenario-part-1-3232fa711442

Snippet:

```
CREATE TABLE packetbeat_flows_by_1m WITH (KEY_FORMAT='JSON') AS
SELECT
source -> ip as srcip,
source -> port as srcport,
destination -> ip as dstip,
destination -> port as dstport,
network -> transport,
SUM(source -> packets) as source_packets,
SUM(source -> bytes) as source_bytes,
SUM(destination -> packets) as destination_packets,
SUM(destination -> bytes) as destination_bytes,
SUM(network -> packets) as network_packets,
SUM(network -> bytes) as network_bytes,
COUNT(*) as cnt
FROM packetbeat_flows
WINDOW TUMBLING (SIZE 1 MINUTE)
GROUP BY source->ip, source-> port, destination->ip, destination->port, network->transport
EMIT CHANGES;
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.