topic Inquiry Regarding Publishing Custom Third-Party IOC Feed via EDL Hosting Service in Next-Generation Firewall Discussions

Inquiry Regarding Publishing Custom Third-Party IOC Feed via EDL Hosting Service

karif_123 — Wed, 10 Dec 2025 10:40:00 GMT

Hello Palo Alto Team,

We are exploring the possibility of integrating a third-party threat intelligence feed (Google Threat Intelligence) into Palo Alto Networks firewalls using External Dynamic Lists (EDLs). While reviewing Palo Alto documentation, we noted the following and would appreciate clarification:

Background

Based on the documentation, standard EDLs require hosting a text-based IOC file on a web server.
We also reviewed documentation for Palo Alto’s EDL Hosting Service, which provides Palo Alto-managed, always-updated EDLs for various SaaS applications.

Our Questions

Is it possible for a third party (e.g., a vendor or developer outside of Palo Alto) to publish a custom IOC feed through Palo Alto’s EDL Hosting Service?
If yes, what is the required process for onboarding such a feed?
Does the EDL Hosting Service support feeds that require authentication (e.g., API key or token)?
Are there prerequisites — such as becoming a technology partner, meeting specific compliance standards, or submitting the integration for approval?

Goal

We aim to enable customers to consume Google Threat Intelligence IOCs through a Palo Alto–hosted EDL, rather than requiring them to maintain their own hosting infrastructure.
We appreciate any guidance or documentation you can provide regarding the feasibility and required steps for publishing a third-party IOC feed within the EDL Hosting Service.

Thank you for your time and assistance.

Re: Inquiry Regarding Publishing Custom Third-Party IOC Feed via EDL Hosting Service

JayGolf — Fri, 12 Dec 2025 05:20:32 GMT

Hi @karif_123 ,

The only way to accomplish this currently is to create a text-based IOC list on a publicly accessible HTTPS server. You could create this list and host it on S3 for quick access. PAN-OS will then pull the feed at the defined interval.

Re: Inquiry Regarding Publishing Custom Third-Party IOC Feed via EDL Hosting Service

karif_123 — Fri, 12 Dec 2025 07:16:18 GMT

Hi @JayGolf ,

Thank you for the clarification.

I understand that the current supported method is to host a text-based IOC list on a publicly accessible HTTPS server—such as S3 and have PAN-OS pull the feed. This would mean we must maintain our own hosting infrastructure for the feed.

However, I wanted to revisit a couple of questions from my original message:

Does the Palo Alto EDL Hosting Service support feeds that require authentication (for example, via API key or token)?
Is there any possibility for a third party (a vendor or developer outside Palo Alto) to publish a custom IOC feed through the Palo Alto–managed EDL Hosting Service?
If this is supported, what would the onboarding or approval process look like?
(e.g., partner requirements, certification steps, technical prerequisites)

Our goal is to allow customers to consume Google Threat Intelligence IOCs through a Palo Alto–hosted EDL similar to the SaaS application EDLs Palo Alto already publishes rather than requiring each customer to host the feed themselves.

Any additional guidance or documentation you can share on these specific points would be greatly appreciated.

Thanks again for your support.

Re: Inquiry Regarding Publishing Custom Third-Party IOC Feed via EDL Hosting Service

karif_123 — Tue, 16 Dec 2025 09:37:51 GMT

Hi @JayGolf ,

Just following up on my previous message below regarding the Palo Alto EDL Hosting Service.

We wanted to confirm whether:

The Palo Alto–managed EDL Hosting Service supports authenticated feeds (for example, using an API key or token)
There is any supported path for a third-party vendor to publish a custom IOC feed through the Palo Alto–hosted EDL service.

Additionally, if such a capability exists, we’d appreciate any details on the onboarding or approval process (partner requirements, certifications, or technical prerequisites).

Our objective is to enable customers to consume Google Threat Intelligence IOCs via a Palo Alto–hosted EDL similar to the SaaS application EDLs already published by Palo Alto rather than requiring each customer to host their own feed.

Any guidance or documentation you can share would be very helpful.

Thanks again for your time and support.