topic Re: Adding threat feeds to NGFW 850 - is there such a feature? in Next-Generation Firewall Discussions

Adding threat feeds to NGFW 850 - is there such a feature?

orlandoc — Mon, 28 Jun 2021 15:23:43 GMT

Greetings,

New to Palo Alto Firewall 850. I am wondering if this firewall has a feature that can ingest threat feeds from MISP.

Please advise.

Re: Adding threat feeds to NGFW 850 - is there such a feature?

OtakarKlier — Tue, 29 Jun 2021 16:44:34 GMT

Hello,

While I have not done this, check out MindMeld:

https://live.paloaltonetworks.com/t5/minemeld/ct-p/MineMeld

It might work for you.

Regards,

Re: Adding threat feeds to NGFW 850 - is there such a feature?

jhurtt — Tue, 29 Jun 2021 17:54:41 GMT

The preferred way is to leverage External Dynamic List (EDLs)

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list.html

If the threat feeds from the MSP are formatted in a text file, there is a high probability one could just ingest them without using MindMeld (as OtakarKlier stated), but MindMeld will assist in normalizing and removing duplicates IOCs from various threat feeds. Also Cortex XSOAR also has the ability process IoC and create EDLs as well with their Threat Intel Management Module.

https://www.paloaltonetworks.com/cortex/threat-intel-management

Hope this Helps.

Re: Adding threat feeds to NGFW 850 - is there such a feature?

LAYER_8 — Tue, 29 Jun 2021 17:56:16 GMT

Minemeld can mine that data and create EDLs, among others. There is also the product "Autofocus", but that may be getting ingested into Cortex soon.

Re: Adding threat feeds to NGFW 850 - is there such a feature?

orlandoc — Fri, 09 Jul 2021 14:42:22 GMT

MISP can produce a text formatted file. I would like to know if in the firewall dashboard itself has a feature that I can define the threat source feed?

Re: Adding threat feeds to NGFW 850 - is there such a feature?

OtakarKlier — Fri, 09 Jul 2021 17:18:34 GMT

Hello,

It depends, if its an IP address or domain, then yes. But not like a SNORT rule.

Regards,