Back to home
Palo Alto

Palo Alto Firewall Integration

Configure ThreatHive as an External Dynamic List (EDL) and enforce it via a Security Policy.

  1. Log in to the PAN-OS web interface Open a browser, navigate to your firewall's management IP, and sign in. Go to the Objects tab.
  2. Create an External Dynamic List
    1. Go to Objects › External Dynamic Lists.
    2. Click Add.
    3. Configure the EDL:
      • Name: ThreatHive_Blocklist
      • Type: IP List
      • Source: https://threathive.net/hiveblocklist.txt
      • Recurring: Five Minute (or the shortest interval available)
      • Description: Malicious IP feed — ThreatHive.net
    4. Click OK.
    5. Click Commit to apply the change.
  3. Create a Security Policy rule to block the list
    1. Navigate to Policies › Security.
    2. Click Add to create a new rule.
    3. Configure the rule:
      • Name: Block_ThreatHive_IPs
      • Source Zone: any (or restrict to untrust)
      • Source Address: ThreatHive_Blocklist
      • Destination Zone: any
      • Action: Deny (or Drop to suppress RST)
      • Log at Session End: Enabled
    4. Position this rule above any broader allow rules.
    5. Click OK, then Commit.
  4. Verify the EDL is loading correctly
    • Go to Objects › External Dynamic Lists.
    • Click the source link for ThreatHive_Blocklist — PAN-OS will show the current IP count and last refresh time.
  5. Monitor traffic
    • Go to Monitor › Traffic or Monitor › Threat.
    • Filter by rule name Block_ThreatHive_IPs to see blocked connections.
    • Forward logs to a SIEM or Panorama for centralized monitoring.
  6. Tips
    • Use a higher-priority allow rule to whitelist any known-good IPs before the block rule if needed.
    • Run in log-only mode initially (set action to Allow with logging) to review matches before enforcing.