Sometimes we are only interrested by a specific kind of indicators in a feed. For example a firewall will not care about file hashes or mutexes.

For this reason we just added a new filter in the feed definition: the observable types!

It is now possible to choose what kind of indicators we want to see in our feed. When a feed includes indicators we can choose the type of the observable they must have in their pattern.

Choosing this option will not prevent seeing other types of object in the feed (campaign, malware, ...).

To get a feed with only ipv4 addresses and nothing else we must choose only the indicator object type and the ipv4-addr observable type.