topic Can comments be added to an EDL? in General Topics

Can comments be added to an EDL?

tshannon — Tue, 07 Aug 2018 15:46:33 GMT

When adding IP's or URL's to EDL's, I was wondering if adding comments after the token is supported? Either it is a TAB or SPACE or some escape character. Has anyone tried this? I don't see it in any of the documentation.

My use case is adding a ticket number or some other identifying mark to tie the line back to an incident.

Re: Can comments be added to an EDL?

BPry — Tue, 07 Aug 2018 15:52:49 GMT

@tshannon,

On the firewall you won't be able to do this; as the firewall simply grabs the indicators present in the EDL and adds them to its cache.

If you are looking to add comments that would really be something that you are adding in your EDL host; for example as a comment added to the indicators in MineMeld. The EDL source would then be the 'master' so to speak of the EDL and any modification that needs to be made should be done through the EDL source.

Re: Can comments be added to an EDL?

gwesson — Tue, 07 Aug 2018 22:02:37 GMT

You can add comments to the list itself. The only requirement is that there is a space after the IP. Here's the documentation talking about syntax requirements for EDL:

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/formatting-guidelines-for-an-external-dynamic-list

The most relevant bit is:

The external dynamic list can include individual IP addresses, subnet
addresses (address/mask), or range of IP addresses. In addition, the
block list can include comments and special characters such as

* , : , ; , #, or /.

The syntax for each line in the list is

[IP address, IP/Mask, or IP start range-IP end range] [space] [comment]

That said, as @BPry eluded to the comment won't show up on the firewall. The comment only exists in the list source, but if it's something you control anyway you can add the comment there.

Re: Can comments be added to an EDL?

tshannon — Wed, 08 Aug 2018 12:17:06 GMT

This is exactly what I was looking for @gwesson. It would be cool if it could pull these comments into the UI, but that is not a requirement. I review the EDL monthly and pull the IP's and URL's into more permanent objects and policies. It also helps determine who added the line with a comment of the user.