---
sourceDocument: Xanadu Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/security-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Submit EDL entries from the blocklist for Palo Alto Networks Next-Generation Firewall

# Submit EDL entries from the blocklist for Palo Alto Networks Next-Generation Firewall {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

For observables determined to be malicious, and not associated with a specific ServiceNow AI Platform security incident, you
submit External Dynamic List (EDL) entries from the blocklist.

## Before you begin

Role required: sn_si.analyst

## About this task

When you want to block an observable that you have determined is malicious, or allow an observable you have determined is not malicious, and the observable is not associated with a specific ServiceNow AI Platform security incident record, you submit EDL entries directly from the blocklist. Examples of these types of EDL entries might be URLs or domains for specific sites.

## Procedure

1. Navigate to AllPalo Alto Networks NGFW IntegrationFirewall EDL Entries.  
2. Click the Firewall EDL Entries module.
3. In the Palo Alto Networks Firewall External Dynamic List Entries list, click New.
4. In the new record that is displayed, in the Entry value field, enter a value for your observable.  
   The two possible outcomes of this entry:

   The remaining fields on the form are completed automatically.
   :   A matching observable is found, and a message is displayed that a
       matching observable exists. Select the EDL you want to attach this
       entry to and click Submit. Select the EDL you
       want to attach this entry to prior to setting the Expiration
       period.

   A message is displayed that instructs you to complete the form.
   :   A matching observable has not been found, and you must complete the
       form. After you complete it, select the EDL you want to attach the
       observable to and click Submit. An observable
       record is created.

   The following figure shows an example of an existing domain observable
   and how the fields are completed automatically.
5. Click the search icon to select the EDL you want to attach the entry to.
6. Click Submit.  
   If you have email approval configured in your workflow, an approval email request is sent.
7. If a message is displayed that requests you to fill in the rest of the information manually, fill in the fields.  

   | Field | Description |
   | Observable type | Observable type that is supported from the dialog. |
   | EDL name | EDL you want to attach the entry to. Note: Select the EDL want to attach the entry to prior to setting the Expiration period. |
   | Enable override (default is selected) | Lookup result or source. When configured, permits you to enter a Lookup result and the source used to find the results. These fields are typically populated when a security incident record is created. In this case, there is no lookup result or source, and you fill in these fields in manually. |
   | Lookup result | Select Unknown or Malicious. |
   | Source | Source that performs a threat lookup on the EDL entry, for example, ThreatCrowd, etc. |
   | Expiration period | The expiration period inherited from the EDL by default. You can override this value, but only during the creation of the entry. <kbd class="ph userinput">0</kbd> indicates that the EDL entry never expires. If you change this value, this entry is active for the number of days you enter. You can enter a minimum value of <kbd class="ph userinput">1</kbd>, and there is no maximum value. For example, if you enter <kbd class="ph userinput">30</kbd> days at 2:01 PM on May 1, the EDL entry will expire at 2:01 PM on May 31. |
   |-|-|

   {#paloalto-submit-entry-fm-blklist__choicetable_r4s_ryh_vdb}
8. Click Submit.  
   If you have changed the default expiration period of the EDL entry, a warning confirmation dialog box is displayed indicating that the period differs from the selected EDL.
9. Choose one option to configure the expiration period.

   | Option | Description |
   | Yes | Confirms your expiration override, saves the record, and returns you to the Palo Alto Networks Firewall External Dynamic List Entries list. If you have email approval configured in your workflow, an approval email request is sent. |
   | No | Cancels the override. At this point, you can change the value for the Expiration period. After changing the value, click Submit to return to the Palo Alto Networks Firewall External Dynamic List Entries list. |
   |-|-|

   {#paloalto-submit-entry-fm-blklist__choicetable_mrw_213_vdb}
10. If not displayed, navigate to the Palo Alto Networks Firewall External Dynamic List Entries list and note that the status for the entry is Pending.  
    The entry is now ready for approval.

## What to do next

Approve EDL entries.
**Previous topic:** [Submit EDL entries from a security incident record for Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/GP~xi5DFUS5H7pHgPR6zyQ "Observables attached to a security incident record are submitted for approval as External Dynamic List (EDL) entries to EDLs. An approval process for EDL entries is part of the preconfigured workflow. The firewall imports EDL entries — IP addresses, URLs, domains — that are included in EDL lists and enforces policy.")  
**Next topic:** [Approve EDL entries for Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/qlIshmmk79HgV3Xmm9md2A "An approval process for External Dynamic List (EDL) entries is part of the preconfigured workflow. You approve EDL entries before the entries are activated on EDLs. One you approve the EDL entry, the firewall retrieves the entry, and your observable is blocked from that point forward.")  
**Related reference**   

* [EDL entry exceptions for Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/k9sY227UfoNRVq3gdcJvgg "There are restrictions for adding External Dynamic List (EDL) entries to EDLs. If duplicate, compatibility, or CIDR (Classless Inter-Domain Routing) conflicts exist when you try to add EDL entries to EDLs, error messages are displayed that help you resolve these errors.")

*[\>]: and then