Network 4 Tuple

Currently ECS has the `network.community_id` which is the 5 tuple consisting of `source port, source ip, destination port, destination ip, and protocol`.

Additionally, I would like to dicuss/propose a 4 tuple consisting of `source ip, destination port, destination ip, and protocol`

This is very useful in following repeated connections between 2 IPs on the same port/applicaiton.

Example: A source/client is targeting Apache on a destination/server. Apache is hosted on port 80 on the destination/server (and because its http, using protocol tcp).
The source/client is repeatedly attempting to perform XSS, Directory Traversal, and other web server attacks.
Having this 4 tuple would allow you to see all the interactions of this client to that server during the "attack".