Generic Export Indicators Service

Use this pack to generate a list based on your Threat Intel Library, and export it to ANY other product in your network, such as your firewall, agent or SIEM. This pack is built for ongoing distribution of indicators from XSOAR to other products in the network, by creating an endpoint with a list of indicators that can be pulled by external vendors.

Simple, manual process to modify external dynamic lists (EDLs) in Cortex XSOAR. This pack may help replace an existing manual process for updating firewall allowlists and blocklists, so analysts may make these changes directly in Cortex XSOAR. You just need to simply paste in a list of indicators to add or remove them from the EDL.

Note: This pack does not perform indicator type validation at this time. Indicators will be added to the EDL exactly as entered.

Simple, manual process to modify external dynamic lists (EDLs) in Cortex XSIAM. This pack may help replace an existing manual process for updating firewall allowlists and blocklists, so analysts may make these changes directly in Cortex XSIAM. You just need to simply paste in a list of indicators to add or remove them from the EDL.

Note: This pack does not perform indicator type validation at this time. Indicators will be added to the EDL exactly as entered.

Incident Fields

Name	Description
Generic Export Indicators Service Type	Only relevant if adding to EDL. Type of indicators to add to EDL.
Generic Export Indicators Service Indicators List	List of IOCs to add to/remove from EDL (according to value of EDL Action). May be newline- or comma-delimited.
Generic Export Indicators Service Tag	Tag that adds indicators to EDL. Must match tag value used in EDL query in the instance configuration.
Generic Export Indicators Service Action	Action to perform on EDL (possible values: Add, Remove)

Incident Types

Name	Description
Generic Export Indicators Service Change

Integrations

Name	Description
Generic Export Indicators Service	Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.

Layouts

Name	Description
EDL Change Layout

Playbooks

Name	Description
Modify EDL	Adds indicators to or removes indicators from an external dynamic list (EDL) by adding or removing an indicator tag. The EDL itself is generated by using the Cortex XSOAR Generic Export Indicators Service integration and querying on a tag in the Indicator Query parameter. Incident fields that control the behavior of this playbook: EDL Action: Whether to add or remove EDL indicators. EDL Indicators List: Input list of indicators to add to or remove from EDL (according to the value of EDL Action). EDL Tag: Tag value in the Generic Export Indicators Service integration instance Indicator Query, which controls which indicators are on the EDL. EDL Indicator Type: (Only relevant if adding to EDL) Type of indicators to add to EDL.
Tag massive and internal IOCs to avoid EDL listing	This playbook tags internal assets and massive IOCs (TLD wildcards and CIDRs) to be avoided by the EDL. The playbook does the following according to indicator type: CIDRs - If the CIDR prefix is larger than the set max prefix it tags it as a `Massive_CIDR` and also with `skip_edl`. TLD Wildcards - If a domainglob is a TLD wildcard (for example, *.net) it will be tagged as `TLD_Wildcard` and also with `skip_edl`. Internal IPs - If an IP is internal and also part of the CIDR configured by the user in the "Internal Assets" list it will be checked as `internal` and tagged with `skip_edl`. Internal Domains - If a domain is a subdomain of the domains configured in the "Internal Assets" list it is checked as `internal` and tagged with `skip_edl`.
PAN-OS EDL Service Configuration	Deprecated. No available replacement. This single-run playbook enables Cortex XSOAR's built-in External Dynamic List (EDL) as a service for system indicators, and configures PAN-OS EDL Objects and the respective firewall policy rules. The EDLs will continuously update for each indicator that matches the query syntax input in the playbook (to validate to which indicators the query applied, you need to enter the query syntax from the indicator tab at the top of the playbook inputs window as well). If both the IP and URL indicator types exist in the query, it sorts the indicators into two EDLs, IP and URL. If only one indicator type exists in the query, only one EDL is created. The playbook then creates EDL objects directing to the indicator lists and firewall policy rules in PAN-OS. It is recommended to configure a dedicated EDL Service instance for the usage of this playbook. If necessary to edit or update the EDL query after this playbook run, use the panorama-edit-edl command and panorama integration to update the URL containing the indicator query syntax.
Block Domain - External Dynamic List	This playbook blocks domains using External Dynamic Link. The playbook adds a tag to the inputs domain indicators. the tagged domains can be publish as External Dynamic list that can be added to blocklist using products like Panorama by Palo Alto Networks. For Panorama - You can block the tagged domains by creating EDL(in Panorama) with the XSOAR EDL Url, and assign it to Anti-Spyware profile under "DNS Signature Policies"

Incident Fields

Name	Description
Generic Export Indicators Service Indicators List	List of IOCs to add to/remove from EDL (according to value of EDL Action). May be newline- or comma-delimited.
Generic Export Indicators Service Type	Only relevant if adding to EDL. Type of indicators to add to EDL.
Generic Export Indicators Service Action	Action to perform on EDL (possible values: Add, Remove)
Generic Export Indicators Service Tag	Tag that adds indicators to EDL. Must match tag value used in EDL query in the instance configuration.

Incident Types

Name	Description
Generic Export Indicators Service Change

Integrations

Name	Description
Generic Export Indicators Service	Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.

Playbooks

Name	Description
Tag massive and internal IOCs to avoid EDL listing	This playbook tags internal assets and massive IOCs (TLD wildcards and CIDRs) to be avoided by the EDL. The playbook does the following according to indicator type: CIDRs - If the CIDR prefix is larger than the set max prefix it tags it as a `Massive_CIDR` and also with `skip_edl`. TLD Wildcards - If a domainglob is a TLD wildcard (for example, *.net) it will be tagged as `TLD_Wildcard` and also with `skip_edl`. Internal IPs - If an IP is internal and also part of the CIDR configured by the user in the "Internal Assets" list it will be checked as `internal` and tagged with `skip_edl`. Internal Domains - If a domain is a subdomain of the domains configured in the "Internal Assets" list it is checked as `internal` and tagged with `skip_edl`.
PAN-OS EDL Service Configuration	Deprecated. No available replacement. This single-run playbook enables Cortex's built-in External Dynamic List (EDL) as a service for system indicators, and configures PAN-OS EDL Objects and the respective firewall policy rules. The EDLs will continuously update for each indicator that matches the query syntax input in the playbook (to validate to which indicators the query applied, you need to enter the query syntax from the indicator tab at the top of the playbook inputs window as well). If both the IP and URL indicator types exist in the query, it sorts the indicators into two EDLs, IP and URL. If only one indicator type exists in the query, only one EDL is created. The playbook then creates EDL objects directing to the indicator lists and firewall policy rules in PAN-OS. It is recommended to configure a dedicated EDL Service instance for the usage of this playbook. If necessary to edit or update the EDL query after this playbook run, use the panorama-edit-edl command and panorama integration to update the URL containing the indicator query syntax.
Modify EDL	Adds indicators to or removes indicators from an external dynamic list (EDL) by adding or removing an indicator tag. The EDL itself is generated by using the Cortex Generic Export Indicators Service integration and querying on a tag in the Indicator Query parameter. Incident fields that control the behavior of this playbook: EDL Action: Whether to add or remove EDL indicators. EDL Indicators List: Input list of indicators to add to or remove from EDL (according to the value of EDL Action). EDL Tag: Tag value in the Generic Export Indicators Service integration instance Indicator Query, which controls which indicators are on the EDL. EDL Indicator Type: (Only relevant if adding to EDL) Type of indicators to add to EDL.
Block Domain - External Dynamic List	This playbook blocks domains using External Dynamic Link. The playbook adds a tag to the inputs domain indicators. the tagged domains can be publish as External Dynamic list that can be added to blocklist using products like Panorama by Palo Alto Networks. For Panorama - You can block the tagged domains by creating EDL(in Panorama) with the XSOAR EDL Url, and assign it to Anti-Spyware profile under "DNS Signature Policies"

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR

All level dependencies (4)

Pack Name	Pack By
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

3.3.6 - 1834150 (December 18, 2024)

Integrations

Generic Export Indicators Service

Added a temporary port for the longRunningPort parameter when using the Test button. This ensures the instance has a functional port until the server assigns one, even if the client does not click Save.
Updated the Docker image to: demisto/flask-nginx:1.0.0.117310.

Related pull requests:
- 37588

Download

3.3.5 - R1773546 (December 8, 2024)

Integrations