Integrating 3rd Party feeds in Palo Alto firewall for blocking IOC's

Majid1Khan — Tue, 07 Mar 2023 20:00:01 GMT

We would like to know if we can integrate 3rd Party feeds in Palo Alto firewall for blocking IOC's automatically.

Generally we seen people integrate Open Source threat intel with SIEM etc with Virus total and IBM Xforce xchange

Re: Integrating 3rd Party feeds in Palo Alto firewall for blocking IOC's

TomYoung — Tue, 07 Mar 2023 20:32:15 GMT

You can create an External Dynamic List https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list that points to a text file of IP addresses or subnets, domains, or URLs. These EDLs can be added to source or destinations in security rules.

This site translates your dshield list to the proper format -> http://opendbl.net/. The greensnow one should work fine as is.

Thanks,

Tom

PS MineMeld can translate STIX feeds or more complicated formats -> https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/minemeld. I think it will eventually be migrated to Cortex XSOAR TIM -> https://www.paloaltonetworks.com/cortex/threat-intel-management. The 1st is free. The 2nd is not.