topic Re: IP Block List Feeds in Next-Generation Firewall Discussions

IP Block List Feeds

MNP-Helpdesk — Tue, 04 Apr 2023 21:01:09 GMT

We're looking to add a dynamic block list rather than manually blocking bad IP's as we find them. I understand that Palo Alto comes with one or more of these feeds, do we know how often they are updated?

Asking for a friend.

Re: IP Block List Feeds

TomYoung — Tue, 04 Apr 2023 21:32:18 GMT

Hi @MNP-Helpdesk ,

The built-in EDLs are updated via content updates. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/built-in-edls

The Applications and Threats are updated every few days, but I don't know if any EDL updates are included with each one.

The URL above also has a link on how to build your own custom EDLs. This is a very cool site -> http://opendbl.net/ but I cannot vouch for it. You could also build your own internal web server. Some customers use MineMeld, which is an open source tool. https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/minemeld

Thanks,

Tom

Re: IP Block List Feeds

OtakarKlier — Tue, 04 Apr 2023 21:56:04 GMT

Hello,

I've been using the edl's for a long time. I just use what Palo Alto has as its only a small portion of your security posture. Make sure to enable everything else, wildfire, AV, Threat, etc.

Regards,