category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: EDL
  version: -1
configuration:
- additionalinfo: Enabling this prevents automatic list refresh.
  display: Update list on demand only
  name: on_demand
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: The query to run to update the indicators list. To view expected results, run the following command from the Cortex XSOAR CLI `!findIndicators query=<your query>`. An empty value may load unwanted indicators. See integration docs for troubleshooting information.
  display: Indicator Query
  name: indicators_query
  type: 0
  section: Collect
  advanced: false
  required: false
- additionalinfo: The format of the exported list.
  defaultvalue: PAN-OS (text)
  display: Outbound Format
  name: format
  options:
  - PAN-OS (text)
  - CSV
  - JSON
  - McAfee Web Gateway
  - Symantec ProxySG
  type: 15
  section: Collect
  advanced: true
  required: false
- additionalinfo: For use with JSON and CSV formats - select specific XSOAR fields to export (comma separated list). If given the value 'all' - all XSOAR fields are exported (in large quantities this can cause a performance issue). If left empty - only value and type are exported.
  display: Exported Fields
  name: fields_filter
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: Maximum number of items in the list.
  defaultvalue: '2500'
  display: List Size
  name: edl_size
  required: false
  type: 0
  section: Collect
- additionalinfo: How often to refresh the list (e.g., less than 1 minute, 5 minutes, 12 hours, 7 days, 3 months, 1 year). For performance reasons, we do not recommend setting this value at less than 1 minute.
  defaultvalue: 30 minutes
  display: Refresh Rate
  name: cache_refresh_rate
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: (For Cortex XSOAR 6.x) For use with HTTPS - the certificate that the service should use. (For Cortex XSOAR 8 and Cortex XSIAM) Custom certificates are not supported.
  display: Certificate (Required for HTTPS)
  name: certificate
  type: 12
  section: Connect
  advanced: true
  required: false
- additionalinfo: (For Cortex XSOAR 6.x) For use with HTTPS - the private key that the service should use.  <br> (For Cortex XSOAR 8 and Cortex XSIAM) When using an engine, configure a private API key. Not supported on the Cortex XSOAR​​ 8 or Cortex XSIAM server.
  display: Private Key (Required for HTTPS)
  name: key
  type: 14
  section: Connect
  advanced: true
  required: false
- additionalinfo: 'The parameter is deprecated and no longer used. Cache locking was replaced by a two-tier fail-fast design that rejects excess concurrent cache-building requests instead of queuing them.'
  defaultvalue: 1h
  display: Cache Lock Timeout (Deprecated)
  name: cache_lock_timeout
  type: 0
  section: Connect
  advanced: true
  required: false
  hidden: true
- additionalinfo: 'The parameter is deprecated and no longer used. Cache locking was replaced by a two-tier fail-fast design that rejects excess concurrent cache-building requests instead of queuing them.'
  defaultvalue: 1h
  display: Cache Lock Age (Deprecated)
  name: cache_lock_age
  type: 0
  section: Connect
  advanced: true
  required: false
  hidden: true
- additionalinfo: The TTL for 404 responses in the cache.
  defaultvalue: 1m
  display: Cache 404 TTL
  name: cache_404_ttl
  type: 0
  section: Connect
  advanced: true
  required: false
- additionalinfo: The default TTL for responses in the cache.
  defaultvalue: 1m
  display: Cache Default TTL
  name: cache_default_ttl
  type: 0
  section: Connect
  advanced: true
  required: false
- additionalinfo: Uses basic authentication for accessing the list. If empty, no authentication is enforced. (For Cortex XSOAR 8 and Cortex XSIAM) Optional for engines, otherwise mandatory.
  display: Username
  name: credentials
  type: 9
  section: Connect
  required: false
  hidden:
  - marketplacev2
  - platform
- additionalinfo: "Runs the service on this port from within Cortex XSOAR. Requires a unique port for each long-running integration instance. Do not use the same port for multiple instances.\nNote: If you click the **Test** button more than once, a failure may occur mistakenly indicating that the port is already in use. (For Cortex XSOAR 8 and Cortex XSIAM) If you do not enter a Listen Port, an unused port for the EDL will automatically be generated when the instance is saved. However, if using an engine, you must enter a Listen Port.                     "
  display: Listen Port
  name: longRunningPort
  type: 0
  section: Connect
  required: true
- additionalinfo: If selected, the comment "# Empty list" is added to an empty list.
  defaultvalue: 'true'
  display: Add comment to empty list
  name: add_comment_if_empty
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: If selected, ports in URLs are removed. For example, 'www.example.com:9999/path' becomes 'www.example.com/path'.
  defaultvalue: 'true'
  display: Strip ports from URLs
  name: url_port_stripping
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: If selected, strips the protocol from URLs (http/https).
  defaultvalue: 'true'
  display: Strip protocols from URLs
  name: url_protocol_stripping
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: If selected, URLs are truncated to no more than 254 characters.
  defaultvalue: 'false'
  display: Truncate URL length
  name: url_truncate
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Enforce ASCII only
  name: enforce_ascii
  type: 8
  additionalinfo: If selected, it will force the list to contain only ASCII chars (non-ASCII URLs will be dropped).
  section: Collect
  advanced: true
  required: false
  defaultvalue: 'false'
- display: Prepend string to list
  name: prepend_string
  type: 12
  additionalinfo: For use with PAN-OS (text) format - String to add to beginning of published list. Supports newline characters (\n).
  section: Collect
  advanced: true
  required: false
- display: Append string to list
  name: append_string
  type: 12
  additionalinfo: For use with PAN-OS (text) format - String to add to end of published list. Supports newline characters (\n).
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'For use with PAN-OS (text) format - collapse method for IPs (none, range, CIDR).'
  defaultvalue: Don't Collapse
  display: 'IP Collapsing'
  name: collapse_ips
  type: 15
  section: Collect
  advanced: true
  required: false
  options:
  - Don't Collapse
  - To CIDRS
  - To Ranges
- additionalinfo: 'CIDRs with a lower network prefix bits number are not included. For example - if the number is 8, then 0.0.0.0/2 is excluded from the list.'
  defaultvalue: 8
  display: 'Maximum Size of CIDR Block (by mask bit)'
  name: maximum_cidr_size
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'Option to remove top level domainGlobs from the list. For example - *.com.'
  display: 'Exclude top level domainGlobs'
  name: no_wildcard_tld
  type: 8
  section: Collect
  advanced: true
  required: false
  defaultvalue: 'false'
- additionalinfo: For use with PAN-OS (text) format - if selected, any URL entry that is not compliant with PAN-OS URL format is dropped instead of rewritten.
  display: "PAN-OS: drop invalid URL entries"
  name: drop_invalids
  type: 8
  required: false
  section: Collect
  advanced: true
- additionalinfo: When set to true and the certificate and private key are provided, the HSTS header is added to all requests.
  defaultvalue: 'false'
  display: "Add HSTS header"
  name: hsts_header
  type: 8
  required: false
  section: Collect
- additionalinfo: For use with McAfee Web Gateway format - set the indicator list type.
  display: "McAfee Gateway: Indicator List Type"
  name: mwg_type
  type: 15
  required: false
  defaultvalue: string
  options:
  - string
  - applcontrol
  - dimension
  - category
  - ip
  - mediatype
  - number
  - regex
  section: Collect
  advanced: true
- additionalinfo: For use with Symantec ProxySG format - set the default category for the output.
  defaultvalue: bc_category
  display: "Symantec ProxySG: Default Category"
  name: category_default
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: For use with Symantec ProxySG format - set the categories that should be listed in the output (comma separated list). If not set, lists all existing categories.
  display: "Symantec ProxySG: Listed Categories"
  name: category_attribute
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: If selected, CSV format appears in a textual webpage instead of initiating a file download.
  display: "Show CSV format as Text"
  name: csv_text
  type: 8
  section: Collect
  required: false
- additionalinfo: Internal page size used when querying Cortex XSOAR for the indicators. Value can be up to 10,000 due to performance limitations.
  display: XSOAR Indicator Page Size
  name: page_size
  type: 0
  section: Collect
  advanced: true
  required: false
  defaultvalue: '10000'
- defaultvalue: 'true'
  display: Long Running Instance
  name: longRunning
  type: 8
  section: Connect
  required: false
  hidden: true
- display: NGINX Global Directives
  name: nginx_global_directives
  type: 0
  section: Connect
  required: false
  additionalinfo: 'NGINX global directives to be passed on the command line using the -g option. Each directive should end with `;`. For example: `worker_processes 4; timer_resolution 100ms;`. Advanced configuration to be used only if instructed by Cortex XSOAR Support.'
  advanced: true
- additionalinfo: 'NGINX server configuration to be used instead of the default NGINX_SERVER_CONF used in the integration code. Advanced configuration to be used only if instructed by Cortex XSOAR Support.'
  display: NGINX Server Conf
  name: nginx_server_conf
  type: 12
  section: Connect
  advanced: true
  required: false
- additionalinfo: NGNIX read timeout in seconds.
  display: NGINX Read Timeout
  name: timeout
  type: 0
  section: Connect
  advanced: true
  required: false
- additionalinfo: 'When enabled, the integration queries the server using full queries (overwrites the "Exported Fields" parameter). Advanced configuration to be used only if instructed by Cortex XSOAR Support, or you have encountered log errors in the form of: msgpack: invalid code.'
  display: 'Advanced: Use Legacy Queries'
  name: use_legacy_query
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Extensive Logging
  name: extensive_logging
  type: 8
  additionalinfo: This parameter will write additional data to the logs and should only be used when you are directed to by XSOAR support.
  section: Connect
  advanced: true
  required: false
  defaultvalue: 'false'
description: Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.
display: Generic Export Indicators Service
name: EDL
script:
  commands:
  - name: edl-update
    arguments:
    - description: The query to run to update the indicators list. To view expected results, run the following command from the Cortex XSOAR CLI `!findIndicators query=<your query>`.
      name: query
    - auto: PREDEFINED
      defaultValue: PAN-OS (text)
      description: The format of the exported list.
      name: format
      predefined:
      - PAN-OS (text)
      - JSON
      - CSV
      - McAfee Web Gateway
      - Symantec ProxySG
      required: true
    - description: Maximum number of items in the list.
      name: edl_size
    - defaultValue: '0'
      description: The starting entry index from which to export the indicators when index 0 is the first position.
      name: offset
    - auto: PREDEFINED
      defaultValue: string
      description: For use with McAfee Web Gateway format - set the indicator list type.
      name: mwg_type
      predefined:
      - string
      - applcontrol
      - dimension
      - category
      - ip
      - mediatype
      - number
      - regex
    - auto: PREDEFINED
      defaultValue: 'True'
      description: If selected, ports in URLs are removed. For example, 'www.example.com:9999/path' becomes 'www.example.com/path'.
      name: url_port_stripping
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'True'
      description: If selected, strips the protocol from URLs (http/https).
      name: url_protocol_stripping
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'False'
      description: For use with PAN-OS (text) format - if selected, any URL entry that is not compliant with PAN-OS URL format is dropped instead of rewritten.
      name: drop_invalids
      predefined:
      - 'False'
      - 'True'
    - auto: PREDEFINED
      defaultValue: Don't Collapse
      description: For use with PAN-OS (text) format - collapse method for IPs (none, range, CIDR).
      name: collapse_ips
      predefined:
      - Don't Collapse
      - To CIDRS
      - To Ranges
    - defaultValue: bc_category
      description: For use with Symantec ProxySG format - set the default category for the output.
      name: category_default
    - description: For use with Symantec ProxySG format - set the categories that should be listed in the output. If not set, lists all existing categories.
      name: category_attribute
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If selected, CSV format appears in a textual webpage instead of initiating a file download.
      name: csv_text
      predefined:
      - 'False'
      - 'True'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If selected, add to an empty list the comment "# Empty list".
      name: add_comment_if_empty
      predefined:
      - 'False'
      - 'True'
    deprecated: true
    description: Updates values stored in the EDL (only available On-Demand).
  - name: export-indicators-list-update
    arguments:
    - description: The query to run to update the indicators list. To view expected results, run the following command from the Cortex XSOAR CLI `!findIndicators query=<your query>`. An empty value may load unwanted indicators.
      name: query
      required: true
    - auto: PREDEFINED
      defaultValue: PAN-OS (text)
      description: The format of the exported list.
      name: format
      predefined:
      - PAN-OS (text)
      - JSON
      - CSV
      - McAfee Web Gateway
      - Symantec ProxySG
      required: true
    - description: Maximum number of items in the list.
      name: edl_size
    - defaultValue: '0'
      description: The starting entry index from which to export the indicators when index 0 is the first position.
      name: offset
    - auto: PREDEFINED
      defaultValue: string
      description: For use with McAfee Web Gateway format - set the indicator list type.
      name: mwg_type
      predefined:
      - string
      - applcontrol
      - dimension
      - category
      - ip
      - mediatype
      - number
      - regex
    - auto: PREDEFINED
      defaultValue: 'True'
      description: If selected, ports in URLs are removed. For example, 'www.example.com:9999/path' becomes 'www.example.com/path'.
      name: url_port_stripping
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'True'
      description: If selected, strips the protocol from URLs (http/https).
      name: url_protocol_stripping
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'False'
      description: For use with PAN-OS (text) format - if selected, any URL entry that is not compliant with PAN-OS URL format is dropped instead of rewritten.
      name: drop_invalids
      predefined:
      - 'False'
      - 'True'
    - auto: PREDEFINED
      defaultValue: Don't Collapse
      description: For use with PAN-OS (text) format - collapse method for IPs (none, range, CIDR).
      name: collapse_ips
      predefined:
      - Don't Collapse
      - To CIDRS
      - To Ranges
    - defaultValue: bc_category
      description: For use with Symantec ProxySG format - set the default category for the output.
      name: category_default
    - description: For use with Symantec ProxySG format - set the categories that should be listed in the output. If not set, lists all existing categories.
      name: category_attribute
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If selected, CSV format appears in a textual webpage instead of initiating a file download.
      name: csv_text
      predefined:
      - 'False'
      - 'True'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If selected, add to an empty list the comment "# Empty list".
      name: add_comment_if_empty
      predefined:
      - 'False'
      - 'True'
    description: Updates values stored in the List (only available On-Demand).
  dockerimage: demisto/flask-nginx:1.0.0.11047721
  longRunning: true
  longRunningPort: true
  script: '-'
  subtype: python3
  type: python
tests:
- Test_EDL
- EDL Performance Test
fromversion: 5.5.0
triggers:
- conditions:
  - name: engine
    operator: not_exists
  - name: isEngineGroup
    operator: not_exists
  effects:
  - name: longRunningPort
    action:
      hidden: true
      required: false