topic Re: Auto update polices to Palo Alto in General Topics

Auto update polices to Palo Alto

dat.tran — Sun, 23 Dec 2012 16:19:12 GMT

Hi all!
I use Splunk to monitor the system. I use a script to automatically extract the IP from Splunk and want to send it to Palo Alto to block this IP?

How do i do it?

Thanks

Re: Auto update polices to Palo Alto

VinceM — Mon, 17 Jun 2013 16:23:26 GMT

This one is ok: https://live.paloaltonetworks.com/docs/DOC-4126

Re: Auto update polices to Palo Alto

gflanagan — Mon, 17 Jun 2013 16:32:15 GMT

got it.

Re: Auto update polices to Palo Alto

Quinton — Wed, 19 Jun 2013 19:26:29 GMT

You could also use Dynamic address objects? Your script basically updates a txt file stored on some http server. This txt file contains a list of IP addresses you extracted from Splunk. Then you define a dynamic address object in PANOS referencing this txt file. The dynamic address object can then be used in your security rules as a source address or destination address.

Re: Auto update polices to Palo Alto

Quinton — Wed, 19 Jun 2013 19:37:25 GMT

Another option could be Dynamic block lists?

Re: Auto update polices to Palo Alto

dat.tran — Sat, 29 Jun 2013 02:45:42 GMT

i tried, thanks you