I am looking to create a more exact feed but I am not sure if it is possible. Is it possible for the feed to label based on ip.src/ip.dst differently?
The main feed we are trying to create is getting each of our IP ranges and label them, we use the whole 10.0.0.0/8 range for us and our clients. What I want it to do is be able to say that if 10.1.1.1 is a source IP label it x_x_src or if it is a dest x_x_dst. Does anyone know if this is possible? I am not sure if using a custom xml would work?
I currently have it working using app rules but I would much rather have it done using a feed so the network team can keep it updated.
Any help is appreciated.