topic Re: Adding a list of IPs and Domains to Exclusion list from File in Json Format in Cortex XSOAR Discussions

Adding a list of IPs and Domains to Exclusion list from File in Json Format

oDarweesh2 — Tue, 22 Nov 2022 14:35:59 GMT

Dears,

Kindly need to add a list of IPs and Domains to exclusion list from json format.

Kindly advise how to do that and what is the needed format?

Re: Adding a list of IPs and Domains to Exclusion list from File in Json Format

Metgatz — Wed, 23 Nov 2022 08:15:43 GMT

Hello @oDarweesh2 , example, you can build an EDL External Dynamic List, but unfortunately Json is not a currently supported format for Palo ALto Firewall.

NOW For XSOAR you can check this link:

https://xsoar.pan.dev/docs/reference/integrations/edl

https://xsoar.pan.dev/docs/reference/playbooks/pan-os---block-ip-and-url---external-dynamic-list-v2

EDL Guidelines:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/formatting-guidelines-for-an-external-dynamic-list

Suggestions:
https://live.paloaltonetworks.com/t5/general-topics/office-365-json-to-flatfile-converter-as-edl-feeder/td-p/325114

Cheers

Re: Adding a list of IPs and Domains to Exclusion list from File in Json Format

oDarweesh2 — Sun, 27 Nov 2022 13:41:43 GMT

Dear Metgatz,

It seem that my request has been misunderstood.

I have list of Domains URLs and IP addresses.

I want to upload them to the exclusion list of indicators in XSOAR to not be extracted as indicators.

So i found there is an option to upload list of indicators in XSOAR from file in JSON format as seen in the screen shot.

The issue is that i don't know what is the syntax or what is the shape in json format needed to be uploaded.

Re: Adding a list of IPs and Domains to Exclusion list from File in Json Format

MBeauchamp2 — Mon, 28 Nov 2022 16:23:32 GMT

A better option may be to write an automation to process the file, and then you can simply use the excludeIndicators command to add the indicators to the exclusion list once the indicators are in context.