topic Probably a simple question in General Topics

Probably a simple question

stevebade — Tue, 27 Feb 2018 21:22:24 GMT

Our product detects malware in network traffic streams (the product does not really matter here). When we generate what we call an event, we know the source/destination ip/port. We have had some customers ask for automatically putting the external (usualy the source) ip address on a block list. the list of blocked ip's will of course grow over time. Of course i'm totaly new to Palo Alto, so i'm not sure what the best way to automate adding an ip to a block list. In some ways, one could consider our product as a block list feed, but i'm wondering

a) is a block list feed the right way, or is there a better way to add to a list of ip's to block

b)what the appropriate api calls would be to accomplish this.

Any examples, or other pointers would be much appreciated

Re: Probably a simple question

OtakarKlier — Tue, 27 Feb 2018 21:35:25 GMT

Hello,

There are a few that are built in and others you can create/manage yourself.

Check out this article.

https://live.paloaltonetworks.com/t5/Featured-Articles/PAN-OS-8-0-IP-Block-List-Feeds/ta-p/129616

Cheers!

Re: Probably a simple question

stevebade — Wed, 28 Feb 2018 16:25:27 GMT

This seems simple enough... just create a file that is accessible via a web server. Is there any specific content/format that is needed, or is it just a simple list of one ip per line.

Re: Probably a simple question

OtakarKlier — Wed, 28 Feb 2018 16:35:14 GMT

Hello,

Here is the link that describes the limits and formats:

https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-and-Limitations/ta-p/58795

Details

Each line of an EBL (External Block List) can be an IP address, IP range, or subnet (IPv6 is supported):

192.168.20.10/32 indicates one IP address
192.168.20.0/24 indicates the subnet
192.168.20.40-192.168.20.50 indicates the IP range
2001:db8:123:1::1 indicates on IP address
2001:db8:123:1::/64 indicates the subnet

Cheers!