03-15-2024 02:51 AM
I enabled EDL in Cortex XDR and I'm trying to add network range, but this seems to be not possible for some reason. Is it supported or only single IPs can be added?
03-15-2024 05:28 AM
Hi @Piotr_Kowalczyk, thanks for reaching us using the Live Community.
The EDLs only accept single IP addresses or domains. Here is the official documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Exte...
If this post answers your question, please mark it as the solution.
03-15-2024 05:28 AM
Hi @Piotr_Kowalczyk, thanks for reaching us using the Live Community.
The EDLs only accept single IP addresses or domains. Here is the official documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Exte...
If this post answers your question, please mark it as the solution.
03-15-2024 06:51 AM
Hey @Piotr_Kowalczyk
Also , another workaround for this is via the action center, where you can upload a mix list of both domains and IP addresses, the total entries for each list you use in a file (CSV format) should not exceed 10,000 entries
Hope that helps!
Z
03-15-2024 06:56 AM
Hi,
Well, this is not really way around for me as I want to blacklist all 1500 subnets which belong to single ISP.
03-15-2024 06:58 AM
Thanks for this reply. It is bad news for me as I wanted to exclude 1500 subnets. Any suggestion where I can keep the EDL? I don't want to have it on our IIS servers and the source must be very reliable.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
