topic Cortex EDL and network range in Cortex XDR Discussions

Cortex EDL and network range

Piotr_Kowalczyk — Fri, 15 Mar 2024 09:51:03 GMT

I enabled EDL in Cortex XDR and I'm trying to add network range, but this seems to be not possible for some reason. Is it supported or only single IPs can be added?

Re: Cortex EDL and network range

jmazzeo — Fri, 15 Mar 2024 12:28:50 GMT

Hi @Piotr_Kowalczyk, thanks for reaching us using the Live Community.

The EDLs only accept single IP addresses or domains. Here is the official documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-External-Dynamic-Lists

If this post answers your question, please mark it as the solution.

Re: Cortex EDL and network range

zarnous — Fri, 15 Mar 2024 13:51:28 GMT

Hey @Piotr_Kowalczyk

Also , another workaround for this is via the action center, where you can upload a mix list of both domains and IP addresses, the total entries for each list you use in a file (CSV format) should not exceed 10,000 entries

Hope that helps!
Z

Re: Cortex EDL and network range

Piotr_Kowalczyk — Fri, 15 Mar 2024 13:56:28 GMT

Hi,

Well, this is not really way around for me as I want to blacklist all 1500 subnets which belong to single ISP.

Re: Cortex EDL and network range

Piotr_Kowalczyk — Fri, 15 Mar 2024 13:58:35 GMT

Thanks for this reply. It is bad news for me as I wanted to exclude 1500 subnets. Any suggestion where I can keep the EDL? I don't want to have it on our IIS servers and the source must be very reliable.