Submit IP to known malicious IP or High Risk IP

[JoshuaSanders]

Can an IP be submitted to Palo Alto to be included in the high-risk or known-malicious IP address lists? We have an IP that has been discovered to be a major DDOS attack BOT coordination point but it's not listed in PAN's threat vault and is not being blocked by our IP list block rules. Talos and other sites lists this as a high risk IP but I'm not seeing anyway to get it on PANs list short of trying to deliver some questionable traffic to the IP and hope that Wildfire picks it up.

[OtakarKlier]

Hello,

I'm sure you can open a ticket and enter all of you evidence. What I do is just setup my telemetry to send to PAN so they make the calls that way. Since your PAN should be blocking it, honestly playing IP whack a mole is tough and not really worth the effort. Submit a ticket to the owner abuse email address?

Regards,

[JoshuaSanders]

How are you sending your telemetry to PAN?

[BPry · Accepted solution]

@JoshuaSanders,

There's not a process for customers to request an IP get added to either of these lists. I'd recommend setting up something that you can easily feed into the firewall for manual IP blocking in cases like this. That can be a manual blacklist entry that you manually update, or you could setup an EDL that can be dynamically updated on a schedule on the firewall so you aren't having to commit just to block an address.

As for sending telemetry to the firewall, you can review the documentation on that HERE. 

[Tim_Stephens]

I found an IP in our logs that has been scanning our network lately. I do not see the IP address in any of the PA Predefined External Dynamic Lists (I.e. Tor Exist IP Address, Bulletproof IP, etc.). However, I do see it on https://www.abuseipdb.com/ as a repeat offender. 

Any suggestions on what URL I could use to pull the this IP address.