Probably a simple question

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Probably a simple question

L1 Bithead

Our product detects malware in network traffic streams (the product does not really matter here).   When we generate what we call an event, we know the source/destination ip/port.   We have had some customers ask for automatically putting the external (usualy the source) ip address on a block list.   the list of blocked ip's will of course grow over time.  Of course i'm totaly new to Palo Alto, so i'm not sure what the best way to automate adding an ip to a block list.  In some ways, one could consider our product as a block list feed, but i'm wondering 

a) is a block list feed the right way, or is there a better way to add to a list of ip's to block

b)what the appropriate api calls would be to accomplish this.

 

Any examples, or other pointers would be much appreciated

1 accepted solution

Accepted Solutions

Hello,

Here is the link that describes the limits and formats:

 

https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-...

 

Details

Each line of an EBL (External Block List) can be an IP address, IP range, or subnet (IPv6 is supported):

  • 192.168.20.10/32 indicates one IP address
  • 192.168.20.0/24 indicates the subnet
  • 192.168.20.40-192.168.20.50 indicates the IP range
  • 2001:db8:123:1::1 indicates on IP address
  • 2001:db8:123:1::/64 indicates the subnet

Cheers!

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

Hello,

There are a few that are built in and others you can create/manage yourself.

 

Check out this article.

https://live.paloaltonetworks.com/t5/Featured-Articles/PAN-OS-8-0-IP-Block-List-Feeds/ta-p/129616

 

Cheers!

 

This seems simple enough... just create a file that is accessible via a web server.  Is there any specific content/format that is needed, or is it just a simple list of one ip per line.

Hello,

Here is the link that describes the limits and formats:

 

https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-...

 

Details

Each line of an EBL (External Block List) can be an IP address, IP range, or subnet (IPv6 is supported):

  • 192.168.20.10/32 indicates one IP address
  • 192.168.20.0/24 indicates the subnet
  • 192.168.20.40-192.168.20.50 indicates the IP range
  • 2001:db8:123:1::1 indicates on IP address
  • 2001:db8:123:1::/64 indicates the subnet

Cheers!

  • 1 accepted solution
  • 1925 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!