topic Re: Cortex XDR EDL in Next-Generation Firewall Discussions

Cortex XDR EDL

OrkhanM — Mon, 05 May 2025 13:09:32 GMT

Hi,

We want to integrate Cortex XDR EDL with PANGFW EDL. We did everything with this guide -- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-External-Dynamic-Lists

After finishing setup we initiated test url access and it gave us url access error. In this case PANGFW cannot retrieve EDL added ip and domain names.

Can anyone help?

Re: Cortex XDR EDL

BPry — Tue, 06 May 2025 20:56:19 GMT

@OrkhanM,

I assume that you can access the EDL with the information that you are using on the firewall? Have you verified that the firewalls traffic to the EDL is actually being allowed through the traffic logs?

Re: Cortex XDR EDL

OrkhanM — Wed, 07 May 2025 12:18:10 GMT

Hi,

I found the problem reason. Problem was the security policy. After creating EDL list in PANGFW you should create block rule for edl inbound to outbound and outbound to inbound. After creating this rule External Dynamic List will reach to the Cortex XDR's EDL and it will retrieve the data (IP and Domain) to Firewall. In our environment Security Policy didn't configured correctly thats why this situation is happened.

Thanks for your time.

Re: Cortex XDR EDL

Estewanalyst — Mon, 20 Oct 2025 18:26:00 GMT

Hello, we had a similar issue to this and applied the EDL IP list to a current EDL policy and it started to populate. the Test URL error apparently means nothing if it populates.

However, I do have an ask - now we are unable to add the Domain XDR EDL list to a URL Policy. It doesn't even show up as an option to add. Has anyone experienced this?