topic Is there an API to add IPs to Cortex XDR EDL programmatically? in Cortex XDR Discussions https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-there-an-api-to-add-ips-to-cortex-xdr-edl-programmatically/m-p/1253638#M9323 <P>Hi community,</P> <P>I'm looking for a way to programmatically add IP addresses to the Cortex XDR External Dynamic List (EDL) via the XDR public API — ideally using a Python script.</P> <P>Currently, I can see that the EDL is referenced in the Audit Log API as an AUDIT_ENTITY value, but I cannot find any dedicated API endpoint to add or manage IPs in the EDL directly.</P> <P>Our use case: We have a SOAR platform that automatically investigates alerts. When an IP is confirmed malicious, we want to run a Python script that automatically pushes it to the XDR EDL so our Palo Alto firewall can block it — without any manual intervention.</P> <P>My questions:<BR />1. Is there any existing API endpoint to add IPs to the XDR EDL (IP Block List)?<BR />2. If not, is this on the roadmap?<BR />3. What is the recommended automated approach for pushing confirmed malicious IPs from a SOAR platform to the XDR EDL?</P> <P>&nbsp;</P> <P>Thank you!</P> Thu, 07 May 2026 15:36:49 GMT N.Majidova 2026-05-07T15:36:49Z Is there an API to add IPs to Cortex XDR EDL programmatically? https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-there-an-api-to-add-ips-to-cortex-xdr-edl-programmatically/m-p/1253638#M9323 <P>Hi community,</P> <P>I'm looking for a way to programmatically add IP addresses to the Cortex XDR External Dynamic List (EDL) via the XDR public API — ideally using a Python script.</P> <P>Currently, I can see that the EDL is referenced in the Audit Log API as an AUDIT_ENTITY value, but I cannot find any dedicated API endpoint to add or manage IPs in the EDL directly.</P> <P>Our use case: We have a SOAR platform that automatically investigates alerts. When an IP is confirmed malicious, we want to run a Python script that automatically pushes it to the XDR EDL so our Palo Alto firewall can block it — without any manual intervention.</P> <P>My questions:<BR />1. Is there any existing API endpoint to add IPs to the XDR EDL (IP Block List)?<BR />2. If not, is this on the roadmap?<BR />3. What is the recommended automated approach for pushing confirmed malicious IPs from a SOAR platform to the XDR EDL?</P> <P>&nbsp;</P> <P>Thank you!</P> Thu, 07 May 2026 15:36:49 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/is-there-an-api-to-add-ips-to-cortex-xdr-edl-programmatically/m-p/1253638#M9323 N.Majidova 2026-05-07T15:36:49Z