Palo Alto External Dynamic List

on

 


  • The predefined External Dynamic Lists available are :-
    • P Bulletproof IP Addresses
      Contains IP addresses provided by bulletproof hosting providers. Because bulletproof hosting providers place few, if any, restrictions on content, attackers frequently use these services to host and distribute malicious, illegal, and unethical material.

    • Known malicious IP addresses
      This list includes malicious IP addresses that are currently used almost exclusively by malicious actors for malware distribution, command-and-control, or for launching various attacks. This list has been verified by our threat research team to be malicious.

    • High-risk IP addresses
      This list includes IP addresses that have recently been featured in threat activity advisories distributed by high-trust organizations; however, Palo Alto Networks does not have direct evidence of maliciousness.

    • Tor exit IP addresses
      IP addresses supplied by multiple providers and validated with Palo Alto Networks threat intelligence data as active Tor exit nodes. Traffic from Tor exit nodes can serve a legitimate purpose, however, is disproportionately associated with malicious activity, especially in enterprise environments.


  • These External Dynamic Lists are available as a part of the Antivirus Dynamic Updates on the Palo Alto Networks Firewalls.

Resolution
  1. Install Antivirus from GUI: Device > Dynamic Updates, before the predefined External Dynamic Lists populate under GUI: Objects > External Dynamic Lists.
  2. A valid Threat Prevention license is required to be loaded on the Palo Alto Networks Firewall for installing Antivirus.
  3. Applications and Threats needs to be installed on the Firewall before installing Antivirus.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM0pCAG





Issue

Anti-Virus database missing from Dynamic Updates page after initial install of licenses.

Resolution

Download and install Applications and Threats database first. Then Refresh the Dynamic Updates page by clicking Check Now to display the available Anti-Virus database

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm1vCAC


Comments

Post a Comment