topic Re: Submit IP to known malicious IP or High Risk IP in General Topics

Submit IP to known malicious IP or High Risk IP

JoshuaSanders — Tue, 24 May 2022 17:28:11 GMT

Can an IP be submitted to Palo Alto to be included in the high-risk or known-malicious IP address lists? We have an IP that has been discovered to be a major DDOS attack BOT coordination point but it's not listed in PAN's threat vault and is not being blocked by our IP list block rules. Talos and other sites lists this as a high risk IP but I'm not seeing anyway to get it on PANs list short of trying to deliver some questionable traffic to the IP and hope that Wildfire picks it up.

Re: Submit IP to known malicious IP or High Risk IP

OtakarKlier — Tue, 24 May 2022 19:11:02 GMT

Hello,

I'm sure you can open a ticket and enter all of you evidence. What I do is just setup my telemetry to send to PAN so they make the calls that way. Since your PAN should be blocking it, honestly playing IP whack a mole is tough and not really worth the effort. Submit a ticket to the owner abuse email address?

Regards,

Re: Submit IP to known malicious IP or High Risk IP

JoshuaSanders — Tue, 14 Jun 2022 18:01:26 GMT

How are you sending your telemetry to PAN?

Re: Submit IP to known malicious IP or High Risk IP

BPry — Wed, 15 Jun 2022 02:31:04 GMT

@JoshuaSanders,

There's not a process for customers to request an IP get added to either of these lists. I'd recommend setting up something that you can easily feed into the firewall for manual IP blocking in cases like this. That can be a manual blacklist entry that you manually update, or you could setup an EDL that can be dynamically updated on a schedule on the firewall so you aren't having to commit just to block an address.

As for sending telemetry to the firewall, you can review the documentation on that HERE.

Re: Submit IP to known malicious IP or High Risk IP

Tim_Stephens — Fri, 26 Apr 2024 01:39:16 GMT

I found an IP in our logs that has been scanning our network lately. I do not see the IP address in any of the PA Predefined External Dynamic Lists (I.e. Tor Exist IP Address, Bulletproof IP, etc.). However, I do see it on https://www.abuseipdb.com/ as a repeat offender.

Any suggestions on what URL I could use to pull the this IP address.