Inquiry Regarding Publishing Custom Third-Party IOC Feed via EDL Hosting Service

[karif_123]

Hello Palo Alto Team,

We are exploring the possibility of integrating a third-party threat intelligence feed (Google Threat Intelligence) into Palo Alto Networks firewalls using External Dynamic Lists (EDLs). While reviewing Palo Alto documentation, we noted the following and would appreciate clarification:

Background

• Based on the documentation, standard EDLs require hosting a text-based IOC file on a web server.
• We also reviewed documentation for Palo Alto’s EDL Hosting Service, which provides Palo Alto-managed, always-updated EDLs for various SaaS applications.

Our Questions

• Is it possible for a third party (e.g., a vendor or developer outside of Palo Alto) to publish a custom IOC feed through Palo Alto’s EDL Hosting Service?
• If yes, what is the required process for onboarding such a feed?
• Does the EDL Hosting Service support feeds that require authentication (e.g., API key or token)?
• Are there prerequisites — such as becoming a technology partner, meeting specific compliance standards, or submitting the integration for approval?

Goal

• We aim to enable customers to consume Google Threat Intelligence IOCs through a Palo Alto–hosted EDL, rather than requiring them to maintain their own hosting infrastructure.
• We appreciate any guidance or documentation you can provide regarding the feasibility and required steps for publishing a third-party IOC feed within the EDL Hosting Service.

Thank you for your time and assistance.

[JayGolf · Accepted solution]

Hi @karif_123 ,

The only way to accomplish this currently is to create a text-based IOC list on a publicly accessible HTTPS server. You could create this list and host it on S3 for quick access. PAN-OS will then pull the feed at the defined interval. 

[karif_123]

Hi @JayGolf ,

Thank you for the clarification.

I understand that the current supported method is to host a text-based IOC list on a publicly accessible HTTPS server—such as S3 and have PAN-OS pull the feed. This would mean we must maintain our own hosting infrastructure for the feed.

However, I wanted to revisit a couple of questions from my original message:

1. Does the Palo Alto EDL Hosting Service support feeds that require authentication (for example, via API key or token)?
2. Is there any possibility for a third party (a vendor or developer outside Palo Alto) to publish a custom IOC feed through the Palo Alto–managed EDL Hosting Service?
3. If this is supported, what would the onboarding or approval process look like?
   (e.g., partner requirements, certification steps, technical prerequisites)

Our goal is to allow customers to consume Google Threat Intelligence IOCs through a Palo Alto–hosted EDL similar to the SaaS application EDLs Palo Alto already publishes rather than requiring each customer to host the feed themselves.

Any additional guidance or documentation you can share on these specific points would be greatly appreciated.

Thanks again for your support.