Block Domain - External Dynamic List

This playbook blocks domains using External Dynamic Link. The playbook adds a tag to the inputs domain indicators. the tagged domains can be publish as External Dynamic list that can be added to blocklist using products like Panorama by Palo Alto Networks. For Panorama - You can block the tagged domains by creating EDL(in Panorama) with the XSOAR EDL Url, and assign it to Anti-Spyware profile under "DNS Signature Policies"

Pack

EDL

Tasks

4

Inputs

• Domains — The domains to block
• Tag — Indicator tag to assign

Commands used

• appendIndicatorField