Block Domain - External Dynamic List

This playbook blocks domains using External Dynamic Link. The playbook adds a tag to the inputs domain indicators. the tagged domains can be publish as External Dynamic list that can be added to blocklist using products like Panorama by Palo Alto Networks. For Panorama - You can block the tagged domains by creating EDL(in Panorama) with the XSOAR EDL Url, and assign it to Anti-Spyware profile under "DNS Signature Policies"

Generic Export Indicators Service · 4 tasks · 2 inputs · 0 outputs

Inputs

  • Domains — The domains to block
  • Tag — Indicator tag to assign

Commands used

appendIndicatorField

Flowchart

yes Start Start Use External Dynamic List? Use External Dynamic List? Update Indicator Tag for EDL - appendIndicatorField Update Indicator Tag for EDL appendIndicatorField Done Done