Integrating 3rd Party feeds in Palo Alto firewall for blocking IOC's

[Majid1Khan]

We would like to know if we can integrate 3rd Party feeds in Palo Alto firewall for blocking IOC's automatically.

Generally we seen people integrate Open Source threat intel with SIEM etc with Virus total and IBM Xforce xchange

https://www.dshield.org/block.txt
https://blocklist.greensnow.co/greensnow.txt
Open source threat intel to block IOC's automatically

[TomYoung]

Hi @Majid1Khan ,

You can create an External Dynamic List https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-pol... that points to a text file of IP addresses or subnets, domains, or URLs.  These EDLs can be added to source or destinations in security rules.

This site translates your dshield list to the proper format -> http://opendbl.net/.  The greensnow one should work fine as is.

Thanks,

Tom

PS MineMeld can translate STIX feeds or more complicated formats -> https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/minemeld.  I think it will eventually be migrated to Cortex XSOAR TIM -> https://www.paloaltonetworks.com/cortex/threat-intel-management.  The 1st is free.  The 2nd is not.