topic Re: Host Firewall API in Cortex XDR Discussions

Host Firewall API

CJNTS — Mon, 08 Jan 2024 20:05:24 GMT

Has anyone had any luck adding IPs to the XDR host firewall via API?

It seems like this would be a great function to have. (Looking at you Palo Alto DEVs)

I've also looked at:

Adding IPs to an IOC - but IOCs cannot be added to custom blocking rules in a policy

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Rule-Management

I've also looked at adding IPs to BIOCs using the above API, but it is only used for adding JSON or CSV to IOCs.

Does anyone have a reasonable method for adding IPs or other IOCs to a blocking profile/ policy via API or in an automated fashion?

Re: Host Firewall API

nsinghvirk — Tue, 16 Jan 2024 13:22:01 GMT

Hello @CJNTS

Thanks for reaching out on LiveCommunity!

Currently there is no API available for uploading IPs directly to host firewall rule. You can raise a feature request for it. As an alternate you can utilise External Dynamic List in order to control user access to IP addresses and domains using Palo Alto Network firewalls. To add IPs you can use Add to EDL option from the Actions menu that is available from investigation pages such as the Incidents View, Causality View, IP View, or Quick Launcher. For more information on EDL please follow below link.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-External-Dynamic-Lists

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Host Firewall API

CJNTS — Tue, 16 Jan 2024 13:28:16 GMT

I agree, and we are already doing this.

We wanted more granular control in the case that a rogue machine was on the same subnet and did not have to traverse a firewall.

I will submit a feature request, but wanted to confirm there was not a way to accomplish this first.

Re: Host Firewall API

Alexandre_Jodoin — Tue, 30 Jan 2024 18:53:56 GMT

@CJNTS

We do have a somewhat similar feature request in already:

CXDR-I-21073 Allow the use of [IP,Domain] IOCs in restriction profiles

Basically, adding IP or domains to a restriction profile, effectively blocking them that way without relying on the host firewall.

It can be done by hash for files, I don't see why it can't be done for IPs. Since Cortex is doing deeppacket inspection anyway...