> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/manage-external-dynamic-lists.md). # Manage external dynamic lists An External Dynamic List (EDL) is a hosted text file. In Cortex AgentiX, you can configure an EDL to share a list of Cortex AgentiX indicators with other products in your network, such as a firewall. For example, your Palo Alto Networks firewall can add IP addresses and domain data from the EDL to block or allow lists. Cortex AgentiX hosts the following external dynamic lists that you can configure and manage: * IP Addresses EDL * Domain Names EDL **Configure an EDL** You can set up an EDL on the Cortex AgentiX tenant or an engine. {% hint style="info" %} ### Note * Configuring custom certificates or private API Keys in the EDL integration instance is supported only on engines, not on the Cortex AgentiX tenant. * For EDL integrations on the tenant, you must set a username and password. For long-running integrations running on an engine, we strongly recommend setting a username and password, but it is not required. You can set credentials for all EDL integrations or for a specific integration instance. {% endhint %}
Configure the EDL in Cortex AgentiX 1. Navigate to **Settings** → **Data Sources & Integrations** → **Add New**. 2. Search for the **Generic Export Indicators Service** integration and click **Add**. 3. If you are using an engine, add the following: * **Listen Port:** The service to access the EDL runs on this port from within Cortex AgentiX. You need a unique port for each long running integration instance (do not use the same port for multiple instances). * **Run on single engine:** Select the engine from a drop-down. 4. Enter an indicator query. The query updates the EDL list. To view expected results, run `!findIndicators query=` from the Cortex AgentiX CLI. Field names in your query must match the machine name for each field. 5. Enter the maximum list size.

Note

If an indicator query returns more indicators than the EDL list size, the list is populated with the most recent n indicators sorted by their last seen timestamp, where n is the maximum size of the EDL.

6.

Important

The EDL URL must always be prefixed by ext-.

\* If using EDL data on the Cortex AgentiX tenant, run the following curl command to access and test the External Dynamic List: ```` `https://ext-/xsoar/instance/execute/` Example 68. ```programlisting curl -v -u user:pass https://ext-mytenant.paloaltonetworks.com/xsoar/instance/execute/edl_instance_01\?q\=type:ip ``` ```` * If using EDL data on an engine run the following curl command to access and test the External Dynamic Lis with the engine URL: `http://:/` Example 69. ```programlisting curl -v -u user:pass http://:/?n=50 ``` 7. Save your changes.
Configure the Firewall to authenticate the EDL 1. Enable the firewall to authenticate the EDL. 1. Download and save the following root certificate: . 2. On the firewall, select Device → Certificate Management → **Certificates** and **Import** the certificate. Make sure to give the device certificate a descriptive name, and select **OK** to save the certificate. 3. Select Device → Certificate Management → **Certificate Profile** and **Add** a new [certificate profile](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/certificate-management/configure-a-certificate-profile). 4. Give the profile a descriptive name and **Add** the certificate to the profile. 5. Select **OK** to save the certificate profile. 2. Set the Cortex AgentiX EDL as the source for a firewall EDL. For more detailed information about how Palo Alto Networks firewall EDLs work, how you can use EDLs, and how to configure them, review how to [Use an External Dynamic List in Policy](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy). 1. On the firewall, select Objects → **External Dynamic Lists** and **Add** a new list. 2. Define the list **Type** as either **IP List** or **Domain List**. 3. Enter the IP Addresses Block List URL or the Domains Block List URL that you recorded in the last step as the list **Source**. 4. Select the **Certificate Profile** that you created in the last step. 5. Select **Client Authentication** and enter the username and password that the firewall must use to access the EDL. 6. Use the **Repeat** field to define how frequently the firewall retrieves the latest list from Cortex AgentiX . 7. Click **OK** to add the new EDL. 3. Select Policies → **Security** and **Add** or edit a security policy rule to add the Cortex AgentiX EDL as match criteria to a security policy rule. Review the different ways you can [Enforce Policy on an External Dynamic List](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/enforce-policy-on-an-external-dynamic-list); this topic describes the complete workflow to add an EDL as match criteria to a security policy rule. 1. Select Policies → **Security** and **Add** or edit a security policy rule. 2. In the **Destination** tab, select **Destination Zone** and select the external dynamic list as the **Destination Address**. 3. Click **OK** to save the security policy rule and **Commit** your changes. You do not need to perform an additional commit or make any subsequent configuration changes for the firewall to enforce the EDL as part of your security policy; even as you update the Cortex AgentiX EDL, the firewall will enforce the list most recently retrieved from Cortex AgentiX .

Tip

You can also use the IP list and URL lists as part of a URL Filtering policy, or the domain list as part of a custom Anti-Spyware profile.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/manage-external-dynamic-lists.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.