Automation rule to add IP address to EDL

[Drew-Browning]

Is it possible to create an automation script or rule to add a remote IP address to an EDL in Cortex XDR?  I'm exploring the best way to handle this.  For example, after the recent CVE-2024-3400 disclosure, I patched my firewalls, and all is good.  However, I still receive daily alerts for the 'Palo Alto Networks GlobalProtect OS Command Injection Vulnerability' attempts.  They are blocked and currently, I manually locate the IP address in the alert, right-click, and add it to the EDL.  The firewall then processes the updated EDL it in the next cycle.  I'm looking to automate this process to avoid repetitive manual tasks. If there’s a better solution, I'm open to suggestions.

[jmazzeo · Accepted solution]

Hi @Drew-Browning, thanks for reaching us using the Live Community.

There is no automated action to add the IP Address from the alerts to the EDL. Maybe adding the IP to a CSV file and then uploading it a few times per day or week can be a better solution. You can upload a file containing IPs or URLs to the EDL using the Action Center.

If this post answers your question, please mark it as the solution.

[Drew-Browning]

I was afraid of that.  Thanks for your response.