Greetings,
My journey continues. Now I would like to have a lookup match either the source or destination IP to an internal department.
This works for src_ip:
transforms.conf
[ipam]
filename = ipam.csv
match_type = CIDR(src_ip)
props.conf
[pan_threat]
LOOKUP-ipam = ipam src_ip OUTPUTNEW Dept AS Department
ipam.csv
src_ip,Dept
10.1.15.0/24,Dept 1
10.1.16.0/24,Dept 1
10.8.1.0/18,Dept 2
10.9.1.0/19,Dept 3
Now I would like to do the same with destination IP.
I tried:
transforms.conf
[dst_ip]
filename = ipam.csv
match_type = CIDR(dst_ip)
props.conf
[pan_threat]
LOOKUP-dst_ip = ipam dst_ip OUTPUTNEW Dept AS Department
ipam.csv
dst_ip,src_ip,Dept
10.1.15.0/24,10.1.15.0/24,Dept 1
10.1.16.0/24,10.1.16.0/24,Dept 1
10.8.1.0/18,10.8.1.0/18,Dept 2
10.9.1.0/19,10.9.1.0/19,Dept 3
But no luck. Thoughts on this would be very much appreciated!