code: def packetbeat_blacklisted_ip(rec):
      """
      author:       gavin (gavinelder)
      description:  Network connection to blacklisted IP.
      testing:      (a) Review traffic logs for machine in question.
      reference:    https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-overview.html
      """
      return (
          ipaddress.IPv4Address(rec["source"]["ip"])
          and rec["dest"]["ip"] in IP_BLACKLIST
      )
  
label_desc: Use image node_id 1 for calling a global function with example usage: packetbeat_blacklisted_ip(rec) and returns: unknown