IP Block List Feeds

[MNP-Helpdesk]

We're looking to add a dynamic block list rather than manually blocking bad IP's as we find them.  I understand that Palo Alto comes with one or more of these feeds, do we know how often they are updated?

Asking for a friend.

[TomYoung]

Hi @MNP-Helpdesk ,

The built-in EDLs are updated via content updates.  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-pol...

The Applications and Threats are updated every few days, but I don't know if any EDL updates are included with each one.

The URL above also has a link on how to build your own custom EDLs.  This is a very cool site -> http://opendbl.net/ but I cannot vouch for it.  You could also build your own internal web server.  Some customers use MineMeld, which is an open source tool.  https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/minemeld

Thanks,

Tom

[OtakarKlier]

Hello,

I've been using the edl's for a long time. I just use what Palo Alto has as its only a small portion of your security posture. Make sure to enable everything else, wildfire, AV, Threat, etc.

Regards,