topic Re: Exclusion criteria import in Cortex XDR Discussions

Exclusion criteria import

RicardoWaffle — Thu, 27 Oct 2022 16:31:36 GMT

Hi all.

Does anyone know of a way - or a work around for the following situation.

I have a long list (about 700) IPs that I want to create an alert exclusion from. These are external scanners that our firewall blocks and we get a large amount of alerts because of this. I would like to create an alert exclusion so we no longer have to deal with these cluttering up our console. Manually entering 700 IPs into the Remote IP criteria field is not an option. Is there a way to get all the IPs into that criteria, or a way to silence these alerts in another way? I would prefer not to use CIDR ranges as I need a little more granularity than that.

Thanks!

Re: Exclusion criteria import

TomYoung — Fri, 28 Oct 2022 01:01:38 GMT

Hi @RicardoWaffle ,

You could use an EDL -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list with the 700 IP addresses and add them to a block security rule (source address) with logging disabled. The cool thing about an EDL is that updates are pushed to the security policy without the need for a commit.

Thanks,

Tom

Re: Exclusion criteria import

bbarmanroy — Fri, 28 Oct 2022 09:05:18 GMT

Hi @RicardoWaffle there are a few workarounds to the ask

1. import all IP addresses to IOC list, and create an exclusion policy for all alert sources as IOC, description containing IP addresses and action as Prevented (or variations of it, depending on how the firewall events are enumerated in XDR). This will exclude all alerts having the term IP in the description (including the ones that are not in the list of 700 IP's).

2. a wider action would be exclude all blocked events from the firewall

Give either action a shot depending on your preference, and see what works best for your environment.

Re: Exclusion criteria import

RicardoWaffle — Mon, 31 Oct 2022 15:20:25 GMT

Thank you both for your replies. Very helpful!

I'll look into each solution for our environment.

Cheers!