Adding a list of IPs and Domains to Exclusion list from File in Json Format

[oDarweesh2]

Dears,

Kindly need to add a list of IPs and Domains to exclusion list from json format.

Kindly advise how to do that and what is the needed format?

[Metgatz]

Hello @oDarweesh2 , example, you can build an EDL External Dynamic List, but unfortunately Json is not a currently supported format for Palo ALto Firewall.

NOW For XSOAR you can check this link:

https://xsoar.pan.dev/docs/reference/integrations/edl

https://xsoar.pan.dev/docs/reference/playbooks/pan-os---block-ip-and-url---external-dynamic-list-v2

EDL Guidelines:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-pol...

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-pol...

Similar Live community:
https://live.paloaltonetworks.com/t5/general-topics/is-json-based-url-is-configurable-in-security-po...

Suggestions:
https://live.paloaltonetworks.com/t5/general-topics/office-365-json-to-flatfile-converter-as-edl-fee...

Cheers

[oDarweesh2]

Dear Metgatz,

It seem that my request has been misunderstood.

I have list of Domains URLs and IP addresses.

I want to upload them  to the exclusion list of indicators in XSOAR to not be extracted as indicators.

So i found there is an option to upload list of indicators in XSOAR from file in JSON format as seen in the screen shot.

The issue is that i don't know what is the syntax or what is the shape in json format needed to be uploaded.

[MBeauchamp2]

A better option may be to write an automation to process the file, and then you can simply use the excludeIndicators command to add the indicators to the exclusion list once the indicators are in context.