Palo Alto Networks integration

Palo Alto Networks integration once configured enables the threat analyst to add malicious IP addresses, URLs, and domains to External Dynamic List (EDL) or remove these entries from EDL once confirmed as non-malicious or clean.

An EDL is a text file that is hosted on an external web server. For this integration, this web server is your ServiceNow AI Platform instance, which permits the Palo Alto Networks Firewall to import objects that are included in the list, IP addresses, URLs, and domains.

• Create new EDL for Palo Alto Networks
  Create new External Dynamic List (EDLs) for Palo Alto Networks. Once you create EDLs, you can start creating entries for those EDLs.
• Palo Alto EDL Approval Rules
  Approval rules allows the users to activate the approval work flow required to approve or reject the EDL entries.
• Add Observables to EDL
  Add observables such as IPs, domains, and hashes to External Dynamic List (EDLs).
• Remove Observables from EDL
  Remove observables from EDL.
• Approve EDL entries for Palo Alto Networks
  Approving External Dynamic List (EDL) entries is part of the pre configuration. You must approve the EDL entries before the entries are activated on EDLs for the firewall to retrieve the entry and apply the security policy.