topic Re: Unblock IP in Cortex XSOAR Discussions

Unblock IP

Himangi — Tue, 02 Jan 2024 05:01:49 GMT

Hi,

I have been using Panorama integration to block the IP. Is there any way where I can unblock the IP or remove the IP from address group of Panorama.

Re: Unblock IP

reaper — Wed, 03 Jan 2024 00:04:17 GMT

can you maybe attach a screenshot of what you are trying to achieve?

are you referring to tags, or to an address group you created in Panorama?

- you can add or remove address objects from an address group by going to the connect `device group > objects` in Panorama

- for tags you can remove the tag by `clear auto-tag vsys <value> ip <ip/netmask>` in the cli

Re: Unblock IP

Himangi — Wed, 03 Jan 2024 11:06:55 GMT

I am referring to an address group which I have created. I am using Pan-OS-Block IP-Static Address Group playbook which is a part of Panorama Integration. Everytime when an IP is found malicious it gets appended in that address group. Is there any way where I can remove some IP's from address group?

Re: Unblock IP

elmitchell — Thu, 04 Jan 2024 17:08:13 GMT

You can use the pan-os-edit-address-group command to achieve this. Just pass the the address group name, address group type, and then also add the arg for element_to_remove which will allow you remove specific IPs from the address group. The command would look something like this !pan-os-edit-address-group name="Bad IPs" type=static element_to_remove=8.8.8.8. This would remove 8.8.8.8 from the static address group named Bad IPs