topic Re: Where do you get additional threat feeds from in General Topics

Where do you get additional threat feeds from

OtakarKlier — Tue, 31 Mar 2020 15:06:13 GMT

Hello All,

Just curious as to what additional threat feeds you use to ingest into your PAN. Here are some of the ones we use:

Would love to hear all of your thoughts whether its into the PAN or SIEM or something else.

Regards,

Re: Where do you get additional threat feeds from

SutareMayur — Tue, 31 Mar 2020 15:45:38 GMT

@OtakarKlier,

We have configured our own feed url on windows based server and added it under EDL. Whenever we find any of malicious/suspicious IP/domain, we add it under site.

We haven't configured any of publically available URLs as given below. The reason being we do not have any control on it.

Mayur

Re: Where do you get additional threat feeds from

johnde — Tue, 31 Mar 2020 16:55:07 GMT

@SutareMayur How to configure own feed url on windows server?

Re: Where do you get additional threat feeds from

SutareMayur — Wed, 01 Apr 2020 06:25:58 GMT

@johndeYou can simply webpage using IIS under windows server. You can refer below link to do the configuration.

https://www.youtube.com/watch?v=abqTcXeyst0

Once your webpage is ready, configure feed url under EDL.

Hope it helps!

Mayur

Re: Where do you get additional threat feeds from

johnde — Wed, 01 Apr 2020 13:23:34 GMT

Great, thanks Mayur.

Re: Where do you get additional threat feeds from

jasonwald — Fri, 03 Apr 2020 19:39:29 GMT

I love firehol

http://iplists.firehol.org/

Re: Where do you get additional threat feeds from

jasonwald — Fri, 30 Oct 2020 14:00:10 GMT

http://panwdbl.appspot.com/lists

Appears to be down. Not sure if the author removed it permanently or not? If so that is a real bummer.

Re: Where do you get additional threat feeds from

OtakarKlier — Fri, 30 Oct 2020 16:46:08 GMT

Hello,

Just a reminder that Palo Alto has a lot of back end feeds and bots that continuously update their stack. I think that a properly configured system with regular updates and dynamic inspection is a good part of an overall security strategy.

Regards,

same here :(

Isaaczarb — Sat, 31 Oct 2020 12:09:47 GMT

same here 😞

Re: Where do you get additional threat feeds from

j04nMan — Tue, 22 Mar 2022 18:30:55 GMT

http://panwdbl.appspot.com/lists/openbl.txt and other panwdbl.appspot.com URLs are now retired.

I'm looking for an SSL abuse list, anyone know of a vetted one?

Re: Where do you get additional threat feeds from

j04nMan — Tue, 22 Mar 2022 18:32:43 GMT

Here's a live TOR Exit Node block list - for ingress

https://www.dan.me.uk/torlist/