topic Block multiple IP's using panorama in Cortex XSOAR Discussions

Block multiple IP's using panorama

Himangi — Thu, 26 Sep 2024 09:51:55 GMT

Hi,
I have been looking for a solution to block multiple IP's at the same time using pan-os integration. Is there any way where multiple IP's are given as input to block from firewall.

Re: Block multiple IP's using panorama

TomYoung — Thu, 26 Sep 2024 12:56:02 GMT

Hi @Himangi ,

Edit: Oops! My bad. This is in the Cortex XSOAR forum. I keep forgetting to check that.

Edit 2: Cortex XSOAR also does EDLs. https://www.paloaltonetworks.com/blog/security-operations/playbook-of-the-week-automating-edl-management/. You may need the TIM module. https://www.paloaltonetworks.com/cortex/threat-intel-management

For the NGFW, you could put the IP addresses in an External Dynamic List. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list You can configure the NGFW to check it every 5 minutes. A commit is not required. An external web server is required. If you don't want to build your own, this one works great! https://edlmanager.com/

Thanks,

Tom

Re: Block multiple IP's using panorama

kreeves — Thu, 26 Sep 2024 13:25:00 GMT

Hi Himangi,

If you are using user-id in your org you can also use ip-tags and Dynamic Groups. ip-tags can get you a faster response that EDL but it may be more complex to implement.

an xsoar example

!pan-os-register-ip-tag tag="tag.test" IPs="1.1.1.1,2.2.2.2" persistent="false" timeout="5" using="PAN-INTEGRATION"