Generic Export Indicators Service

This playbook blocks domains using External Dynamic Link.
The playbook adds a tag to the inputs domain indicators. the tagged domains can be publish as External Dynamic list that can be added to blocklist using products like Panorama by Palo Alto Networks.
For Panorama - You can block the tagged domains by creating EDL(in Panorama) with the XSOAR EDL Url, and assign it to Anti-Spyware profile under "DNS Signature Policies"

Deprecated. No available replacement. This single-run playbook enables Cortex XSOAR's built-in External Dynamic List (EDL) as a service for system indicators, and configures PAN-OS EDL Objects and the respective firewall policy rules.
The EDLs will continuously update for each indicator that matches the query syntax input in the playbook
(to validate to which indicators the query applied, you need to enter the query syntax from the indicator tab at the top of the playbook inputs window as well).
If both the IP and URL indicator types exist in the query, it sorts the indicators into two EDLs, IP and URL. If only one indicator type exists in the query, only one EDL is created.
The playbook then creates EDL objects directing to the indicator lists and firewall policy rules in PAN-OS.

• It is recommended to configure a dedicated EDL Service instance for the usage of this playbook.
• If necessary to edit or update the EDL query after this playbook run, use the panorama-edit-edl command and panorama integration to update the URL containing the indicator query syntax.

Adds indicators to or removes indicators from an external dynamic list (EDL) by adding or removing an indicator tag. The EDL itself is generated by using the Cortex XSOAR Generic Export Indicators Service integration and querying on a tag in the Indicator Query parameter.

Incident fields that control the behavior of this playbook:

• EDL Action: Whether to add or remove EDL indicators.
• EDL Indicators List: Input list of indicators to add to or remove from EDL (according to the value of EDL Action).
• EDL Tag: Tag value in the Generic Export Indicators Service integration instance Indicator Query, which controls which indicators are on the EDL.
• EDL Indicator Type: (Only relevant if adding to EDL) Type of indicators to add to EDL.

This playbook tags internal assets and massive IOCs (TLD wildcards and CIDRs) to be avoided by the EDL. The playbook does the following according to indicator type:

CIDRs - If the CIDR prefix is larger than the set max prefix it tags it as a Massive_CIDR and also with skip_edl.

TLD Wildcards - If a domainglob is a TLD wildcard (for example, *.net) it will be tagged as TLD_Wildcard and also with skip_edl.

Internal IPs - If an IP is internal and also part of the CIDR configured by the user in the "Internal Assets" list it will be checked as internal and tagged with skip_edl.

Internal Domains - If a domain is a subdomain of the domains configured in the "Internal Assets" list it is checked as internal and tagged with skip_edl.

Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.

Only relevant if adding to EDL. Type of indicators to add to EDL.

List of IOCs to add to/remove from EDL (according to value of EDL Action). May be newline- or comma-delimited.

Action to perform on EDL (possible values: Add, Remove)

Tag that adds indicators to EDL. Must match tag value used in EDL query in the instance configuration.

Only relevant if adding to EDL. Type of indicators to add to EDL.

Tag that adds indicators to EDL. Must match tag value used in EDL query in the instance configuration.

Action to perform on EDL (possible values: Add, Remove)

List of IOCs to add to/remove from EDL (according to value of EDL Action). May be newline- or comma-delimited.

This playbook tags internal assets and massive IOCs (TLD wildcards and CIDRs) to be avoided by the EDL. The playbook does the following according to indicator type:

CIDRs - If the CIDR prefix is larger than the set max prefix it tags it as a Massive_CIDR and also with skip_edl.

TLD Wildcards - If a domainglob is a TLD wildcard (for example, *.net) it will be tagged as TLD_Wildcard and also with skip_edl.

Internal IPs - If an IP is internal and also part of the CIDR configured by the user in the "Internal Assets" list it will be checked as internal and tagged with skip_edl.

Internal Domains - If a domain is a subdomain of the domains configured in the "Internal Assets" list it is checked as internal and tagged with skip_edl.

This playbook blocks domains using External Dynamic Link.
The playbook adds a tag to the inputs domain indicators. the tagged domains can be publish as External Dynamic list that can be added to blocklist using products like Panorama by Palo Alto Networks.
For Panorama - You can block the tagged domains by creating EDL(in Panorama) with the XSOAR EDL Url, and assign it to Anti-Spyware profile under "DNS Signature Policies"

Deprecated. No available replacement. This single-run playbook enables Cortex XSIAM's built-in External Dynamic List (EDL) as a service for system indicators, and configures PAN-OS EDL Objects and the respective firewall policy rules.
The EDLs will continuously update for each indicator that matches the query syntax input in the playbook
(to validate to which indicators the query applied, you need to enter the query syntax from the indicator tab at the top of the playbook inputs window as well).
If both the IP and URL indicator types exist in the query, it sorts the indicators into two EDLs, IP and URL. If only one indicator type exists in the query, only one EDL is created.
The playbook then creates EDL objects directing to the indicator lists and firewall policy rules in PAN-OS.

• It is recommended to configure a dedicated EDL Service instance for the usage of this playbook.
• If necessary to edit or update the EDL query after this playbook run, use the panorama-edit-edl command and panorama integration to update the URL containing the indicator query syntax.

Adds indicators to or removes indicators from an external dynamic list (EDL) by adding or removing an indicator tag. The EDL itself is generated by using the Cortex XSIAM Generic Export Indicators Service integration and querying on a tag in the Indicator Query parameter.

Incident fields that control the behavior of this playbook:

• EDL Action: Whether to add or remove EDL indicators.
• EDL Indicators List: Input list of indicators to add to or remove from EDL (according to the value of EDL Action).
• EDL Tag: Tag value in the Generic Export Indicators Service integration instance Indicator Query, which controls which indicators are on the EDL.
• EDL Indicator Type: (Only relevant if adding to EDL) Type of indicators to add to EDL.

Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.