https://live.paloaltonetworks.com/t5/expedition-discussions/machine-learning/m-p/470547#M3873 <P>I'd like to get some clarity on the learning results from ML function. I noticed that some "common" apps&nbsp; do not provide src and dst address - show as "any" while others "global" provide src and dst addresses. What is the criteria for presenting any in src or dst fields? Thanks for responding.</P> Fri, 04 Mar 2022 14:48:39 GMT frocchio1 2022-03-04T14:48:39Z https://live.paloaltonetworks.com/t5/expedition-discussions/machine-learning/m-p/470547#M3873 <P>I'd like to get some clarity on the learning results from ML function. I noticed that some "common" apps&nbsp; do not provide src and dst address - show as "any" while others "global" provide src and dst addresses. What is the criteria for presenting any in src or dst fields? Thanks for responding.</P> Fri, 04 Mar 2022 14:48:39 GMT https://live.paloaltonetworks.com/t5/expedition-discussions/machine-learning/m-p/470547#M3873 frocchio1 2022-03-04T14:48:39Z https://live.paloaltonetworks.com/t5/expedition-discussions/machine-learning/m-p/470598#M3874 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/72950">@frocchio1</a>&nbsp;Common apps like cloud application, since it contains dynamic src or dst address, so ML result will contain "any" in the src or dst, since the IP for that cloud application will be changing.&nbsp;</P> Fri, 04 Mar 2022 16:34:27 GMT https://live.paloaltonetworks.com/t5/expedition-discussions/machine-learning/m-p/470598#M3874 lychiang 2022-03-04T16:34:27Z