Where do you get additional threat feeds from

[OtakarKlier]

Hello All,

Just curious as to what additional threat feeds you use to ingest into your PAN. Here are some of the ones we use:

Threat intelligence blocklists
https://talosintelligence.com/documents/ip-blacklist
http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
http://panwdbl.appspot.com/
http://www.spamhaus.org/drop/drop.txt
http://www.spamhaus.org/drop/edrop.txt
http://panwdbl.appspot.com/lists/openbl.txt
http://panwdbl.appspot.com/lists/bruteforceblocker.txt
http://panwdbl.appspot.com/lists/mdl.txt
http://panwdbl.appspot.com/lists/ettor.txt
http://panwdbl.appspot.com/lists/etcompromised.txt
http://panwdbl.appspot.com/lists/dshieldbl.txt
http://panwdbl.appspot.com/lists/sslabuseiplist.txt
http://panwdbl.appspot.com/lists/zeustrackerbadips.txt

Would love to hear all of your thoughts whether its into the PAN or SIEM or something else. 

Regards,

[SutareMayur]

@OtakarKlier,

We have configured our own feed url on windows based server and added it under EDL. Whenever we find any of malicious/suspicious IP/domain, we add it under site.

We haven't configured any of publically available URLs as given below. The reason being we do not have any control on it.

Mayur

[johnde]

@SutareMayur How to configure own feed url on windows server?

[SutareMayur]

@johndeYou can simply webpage using IIS under windows server. You can refer below link to do the configuration.

https://www.youtube.com/watch?v=abqTcXeyst0

Once your webpage is ready, configure feed url under EDL.

Hope it helps!

Mayur

[johnde]

Great, thanks Mayur.

[jasonwald]

I love firehol

http://iplists.firehol.org/

[jasonwald]

http://panwdbl.appspot.com/lists

Appears to be down. Not sure if the author removed it permanently or not? If so that is a real bummer.

[OtakarKlier]

Hello,

Just a reminder that Palo Alto has a lot of back end feeds and bots that continuously update their stack. I think that a properly configured system with regular updates and dynamic inspection is a good part of an overall security strategy.

Regards,

[Isaaczarb]

same here 😞

[j04nMan]

http://panwdbl.appspot.com/lists/openbl.txt and other panwdbl.appspot.com URLs are now retired. 

I'm looking for an SSL abuse list, anyone know of a vetted one?

[j04nMan]

Here's a live TOR Exit Node block list - for ingress

https://www.dan.me.uk/torlist/