Auto update polices to Palo Alto

[dat.tran]

Hi all!
I use Splunk to monitor the system. I use a script to automatically extract the IP from Splunk and want to send it to Palo Alto to block this IP?

How do i do it?

Thanks

[VinceM]

This one is ok: https://live.paloaltonetworks.com/docs/DOC-4126

V.

[gflanagan]

got it.

TY

[Quinton]

You could also use Dynamic address objects? Your script basically updates a txt file stored on some http server. This txt file contains a list of IP addresses you  extracted  from Splunk. Then you define a dynamic address object in PANOS referencing this txt file. The dynamic address object can then be used in your security rules as a source address or destination address.

[Quinton]

Another option could be Dynamic block lists?

[dat.tran]

i tried, thanks you