# adding srcip to correlation script **URL:** \ **Category:** Zeek\ **Created:** [January 2, 2015, 4:46pm UTC](https://community.zeek.org/t/adding-srcip-to-correlation-script/3408 "2015-01-02T16:46:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [January 2, 2015, 4:46pm UTC](https://community.zeek.org/t/adding-srcip-to-correlation-script/3408/1 "2015-01-02T16:46:34Z")
I’m working with the correlation script released by CrowdStrike, thank you BTW, and I want to populated the “srcip” field with the correct source IP so that I can do a groupby on that field in ELSA. How do I get the conn record for this connection into the below function so that I can add $conn=c to the notice? Not sure what the best way to do this is; can I just add it to the function arguments or define “c” as a local and then assign the source IP, “idx” in this case, to c$id$orig\_h. function alerts\_out(t: table[addr] of set[string], idx: addr): interval thanks, Brian ---
**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\ **Post date:** [January 10, 2015, 1:36am UTC](https://community.zeek.org/t/adding-srcip-to-correlation-script/3408/2 "2015-01-10T01:36:20Z")
Hi Brian, I wrote the script you're referring to, so hopefully I can help. (Sorry for taking so long to reply to your message, I meant to do this earlier but haven't had time.) I don't use ELSA, but based on your description it sounds like it parses the Bro notice c$id fields and not the src or dst fields. This script doesn't use the c$id fields since no connection record exists after correlation has taken place; the only field containing a connection artifact is the src field, so that is the field you would want to groupby. It sounds like the fix for this could be in ELSA, but if you'd like to alter the Bro script to support the ELSA srcip field as it is now, then this (ugly solution) should work: Change this line in each notice: $src=idx, To this: $id=[$orig\_h=idx,$orig\_p=0/tcp,$resp\_h=0.0.0.0,$resp\_p=0/tcp], By doing that, we're faking a full connection record to get the idx value into the c$id$orig\_h field (and thus the srcip field in ELSA). Hope this helps! Let me know if I was way off base. Josh ---
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [January 12, 2015, 1:32pm UTC](https://community.zeek.org/t/adding-srcip-to-correlation-script/3408/3 "2015-01-12T13:32:36Z")
Thanks for the response. I tried something similar already, but it wants the connection unique ID field filed as well and haven't figured out how to handle that yet. Haven't had time to play with it beyond my first attempt. Thanks ---
**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\ **Post date:** [January 13, 2015, 6:35am UTC](https://community.zeek.org/t/adding-srcip-to-correlation-script/3408/4 "2015-01-13T06:35:20Z")
It sounds odd that ELSA requires the conn uid field-- there are many scripts that do not put conn uid values in the notice. Out of curiosity, have you (or anyone) seen any scanning notices in ELSA? ---
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [January 13, 2015, 1:46pm UTC](https://community.zeek.org/t/adding-srcip-to-correlation-script/3408/5 "2015-01-13T13:46:24Z")
Sorry, I was getting an error in Bro about the Conn ID field; not ELSA. And the notices were not showing up in notice.log. I probably just missed something simple. I really didn’t have time to look into it. I see scanning notices in ELSA, but they come in with the default of the loopback IP for src and dst unfortunately. So it can make them hard to correlate. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/adding-srcip-to-correlation-script/3408/6 "2022-05-06T15:42:19Z")