Is there an API to add IPs to Cortex XDR EDL programmatically?

[N.Majidova]

Hi community,

I'm looking for a way to programmatically add IP addresses to the Cortex XDR External Dynamic List (EDL) via the XDR public API — ideally using a Python script.

Currently, I can see that the EDL is referenced in the Audit Log API as an AUDIT_ENTITY value, but I cannot find any dedicated API endpoint to add or manage IPs in the EDL directly.

Our use case: We have a SOAR platform that automatically investigates alerts. When an IP is confirmed malicious, we want to run a Python script that automatically pushes it to the XDR EDL so our Palo Alto firewall can block it — without any manual intervention.

My questions:
1. Is there any existing API endpoint to add IPs to the XDR EDL (IP Block List)?
2. If not, is this on the roadmap?
3. What is the recommended automated approach for pushing confirmed malicious IPs from a SOAR platform to the XDR EDL?

Thank you!