Dynamic External Lists for Hostnames

[Chris_Julio]

Trying to figure out the best way to accomplish a task. 

1. We have a "Suspicious" rule on our firewall that should be where we place hostnames for users that are observed to have questionable traffic.
2. This will be a dynamic list that will be updated by adding/removing hosts at any given time depending on security alerts
3. Since we use LDAP I know we can add the hosts directly to the rule

QUESTION: Has anyone used an External Dynamic List for hostnames to be added to the rule?

Thank you 

[hshawn]

It sounds like you have a few options here

1. Use Minemeld and point it to something you are using to host/build a list of hosts

2. Create a tag and dynamic group then add your objects and use the tag and build the policy using the group

3. Instead of using the user's source IP create a custom URL profile and add the nuisance sites into it then set that profile to block or continue

We are doing all of the above

[BPry]

@Chris_Julio,

To the best of my knowledge a tag and a dynamic address-group is going to be the cleanest way of doing this; hostnames are not currently a valid option when using an EDL.