About Majid1Khan

Hi @Majid1Khan ,   I’ve taken a look at your list of exceptions received from Microsoft.  It appears that some of them are individual files/file types.  Others such as $db_normal$ appear to refer to a certain location on disk.  Looking at this Microsoft documentation I was able to find references to what you were given.   SYSVOL Exceptions $db_normal$ - See below FileIDTable_* - See below SimilarityTable_* - See below *.xml - File Type   $db_dirty$ - See below $db_clean$ - See below $db_lost$ - See below Dfsr.db - File Type Fsr.chk - File Type *.frx - File Type *.log - File Type Fsr*.jrs - File Type Tmp.edb - File Type       In the screenshot above you can see a lot of the file types you mentioned in your previous post.  I hope this helps clarify the exceptions you would need to input into Cortex XDR.   Please reply to this comment if you have any further questions.  We’re happy to help.   Have a great day! ... View more

Hi @Majid1Khan ,   You can create an External Dynamic List https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list that points to a text file of IP addresses or subnets, domains, or URLs.  These EDLs can be added to source or destinations in security rules.   This site translates your dshield list to the proper format -> http://opendbl.net/.  The greensnow one should work fine as is.   Thanks,   Tom   PS MineMeld can translate STIX feeds or more complicated formats -> https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/minemeld.  I think it will eventually be migrated to Cortex XSOAR TIM -> https://www.paloaltonetworks.com/cortex/threat-intel-management.  The 1st is free.  The 2nd is not. ... View more