Questions about EDL

[Charlie80]

Hello,

I have a firewall rule on the Internet Firewall list this

Source: Palo Alto Networks - High risk IP addresses - Palo Alto Networks - Known malicious IP addresses

Destination Any

Service Any

Action: drop

So if an ip inside the two EDL try to reach a Public Customer Service will be drop right?

How is this list updated? There is a package like the Threat that I have to download with the PA scheduler?

I found an ip that is flagged  as malicious by AbuseIPDB with the 28% of confidence.

I check the same ip on the Internet firewall:

request system external-list global-find string x.x.x.x

the answer was IP not present in the list.

So It's means that Palo Alto didn't consider this ip malicious?

[kiwi]

Hi @Charlie80 

Yes, an IP within the EDL should be dropped by your policy.

With an active Threat Prevention license, Palo Alto Networks provides multiple built-in dynamic IP lists that you can use to block malicious hosts. The list is updated daily.  The download is part of the Threats dynamic update schedule.

Kind regards,

-Kim.

[Charlie80]

Thanks,

Have you any idea regarding the last question?

I found an ip that is flagged  as malicious by AbuseIPDB with the 28% of confidence.

I check the same ip on the Internet firewall:

request system external-list global-find string x.x.x.x

the answer was IP not present in the list.

So It's means that Palo Alto didn't consider this ip malicious?

[Remo · Accepted solution]

Hi @Charlie80 

It does not necessary mean that paloalto consider it as benign, but maybe it is simply not confident enough to add it as the goal also is to have as few as possible false positives. 28% confidence on abjseIP is also not that high. In addition you will always find other sources with additional IP/URLs that are not blocked by paloalto as this company also does not know everything. Sometimes it makes sense to create such drop policies with more than just one list.

@kiwi isn't it updated with the antivirus updates as only this one is updated daily?

[ltinetwork]

Hello Team,

We are not able to add Predefine EDL list into the security Policy. Please help on it.

[kiwi]

Hi @ltinetwork ,

What seems to be the problem ? 

With an active Threat Prevention license, Palo Alto Networks provides built-in IP address EDLs that you can use to protect against malicious hosts.  You should be able to select them as a source or destination address object in a Security Policy Rule as shown below.

What seems to be the problem exactly ?

You don't see them ? Is your threat license active ?

Kind regards,

-Kim.