PAN-OS EDL Service Configuration

Deprecated. No available replacement. This single-run playbook enables Cortex XSOAR's built-in External Dynamic List (EDL) as a service for system indicators, and configures PAN-OS EDL Objects and the respective firewall policy rules. The EDLs will continuously update for each indicator that matches the query syntax input in the playbook (to validate to which indicators the query applied, you need to enter the query syntax from the indicator tab at the top of the playbook inputs window as well). If both the IP and URL indicator types exist in the query, it sorts the indicators into two EDLs, IP and URL. If only one indicator type exists in the query, only one EDL is created. The playbook then creates EDL objects directing to the indicator lists and firewall policy rules in PAN-OS. - It is recommended to configure a dedicated EDL Service instance for the usage of this playbook. - If necessary to edit or update the EDL query after this playbook run, use the panorama-edit-edl command and panorama integration to update the URL containing the indicator query syntax.

Pack

EDL

Tasks

43

Inputs

• ip-edl-object-name — Set a name for the EDL object that will be configured on PAN-OS. This value is used to set the rule name as well.
• url-edl-object-name — Set a name for the EDL object that will be configured on PAN-OS. This value is used to set the rule name as well.
• EDLServiceURL — The EDL service provides serval access methods to the EDL instance. By default, it uses a unique port, configured in the EDL Service integration, and an HTTP session. It is possible to either configure a certificate for the default option or to access the EDL by instance name, which is HTTPS by default. Please refer to the EDL Service integration tip for more information. EDLServiceURL input Examples: 1. if not configured with a certificate - http://cortex-xsoar_address 2. if configured with a certificate - https://cortex-xsoar_address * Depending on the access method to the EDL, the full URL of the EDL is constructed from this input, and by InstanceName OR by InstacePort and IndicatorQuery. The playbook identifies which access method is used from the playbook inputs and crafts the correct URL address. Full constructed URL examples: 1. by port - ${EDLServiceURL}:${InstancePort}/${IndicatorQuery} 2. By Instance Name - ${EDLServiceURL}:${InstanceName}/${IndicatorQuery}
• InstanceName — Name of the instance as configured in EDL Service integration. Only needed when accessing EDL Service by instance name. Refer to the EDL Service integration tip for more information.
• InstancePort — Instance name port as configured in EDL Service integration. Only needed when accessing EDL Service by URL and Port. Refer to the EDL Service integration tip for more information.
• IndicatorQuery — The query to run to create the EDL. When no query is entered, EDLs will contain all IP and URL indicators. The query should be inserted in the indicators tab(top of this input window) so the playbook can query and validate the indicator types and create only the relevant EDL objects and rules.
• AutoCommit — This input establishes whether to commit the configuration automatically. Yes - Commit automatically. No - Commit manually.
• RulePosition — The position of the rule in the ruleset. Valid values are: * top * bottom * before * after The default position is 'top'
• ActionType — The action that will be defined in the rule: allow/deny/drop
• inbound-or-outbound-rule — Determines if the rule is inbound or outbound.
• pre-post-rulebase — Either pre-rulebase or post-rulebase, according to the rule structure.
• DeviceGroup — The device group to work on. Exists only in panorama!
• LogForwarding — Log Forwarding object name.
• relative-rule-name — If the rule-position that is chosen is before or after, specify the rule name to which it is related.

Outputs

• Panorama.EDL.Name — Name of theEDL.

Commands used

• pan-os-create-edl
• pan-os-get-edl
• pan-os-list-rules