predefined IP address feeds are too small

Showing results for 
Show  only  | Search instead for 
Did you mean: 

predefined IP address feeds are too small

L1 Bithead



I am checking the content of two predefined dynamic IP lists for high risky IP addresses and known malicious IP addresses and they are too small, just 613 addresses in total. 

 There is a document

and there we can find that at the time of writing there were 2969 IP addresses only in high risky list. 

 So the question, if it can be some problem with feed updates on our appliances or it is the actual size of these lists. 





Accepted Solutions


If you want to have other EBL's check these out:


Source on PAN support:


Sans notes on this:


Others listed on this site:


However remember that IP's change frequently and a proper security poster also takes DNS and URL filtering into consideration.



View solution in original post


L4 Transporter

@vladimir.stepanov There is nothing wrong with your appliance, they are around 600 now. The list is updated regularly with the anti-virus updates and the numbers can change when new IPs are added or removed. 


But why it is like this, was there any announce or answer from paloalto? It is clear that 600 Ip addresses are nothing, also, before they had 10 times bigger list. So what, have paloalto failed with this feature and cannot support it anymore?


@vladimir.stepanov You should not rely too much on the pre-defined lists. They have never been a comprehensive security feed, but just a small addition to all the other firewall security features and profiles.   

yes, I understand that I cannot rely on them since paloalto doesn't maintain it.  But the question is what to use instead to block traffic from well-known malicious IP addresses. Ok, I mean well-known to other companies, not to paloalto, since their feeds are empty 🙂




Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!