Panoroma IP Blocking Issue

UmutAK — Thu, 02 Mar 2023 07:29:16 GMT

I wanted to block ips via using xsoar, on Pan-os panorama. We have integrated xsoar and panoroma but non of the automations provide us a blocking on panorama. In addition to that I tried to give inputs to Block IP Generic v3 playbook(which is provided by palo alto). Our aim is blocking IP **WITHOUT** using edl or static list, which corresponds DAG(dynamic address group) section of your playbook. However we can not see any blocking operations on prisma or any sort of firewall. To sum up, I want to block ips just using panoroma xsoar integration by using Dynamic Address Group. Whenever we are checking ips from panoroma I can only see that xsoar alters corresponding address group but can not add any ip to block.

Re: Panoroma IP Blocking Issue

dyanuck — Wed, 26 Apr 2023 18:41:06 GMT

Hi UmutAK, can you confirm if this issue is still occurring? If so, can you please verify if your Dynamic Address group is defined appropriately in the policies you want to commit to?

Also, are you using the following playbook? https://xsoar.pan.dev/docs/reference/playbooks/pan-os-dag-configuration

topic Panoroma IP Blocking Issue in Cortex XSOAR Discussions

Panoroma IP Blocking Issue

Re: Panoroma IP Blocking Issue