> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/manage-external-dynamic-lists.md). # Manage external dynamic lists An External Dynamic List (EDL) is a hosted text file. In Cortex XSIAM, you can configure an EDL to share a list of Cortex XSIAM indicators with other products in your network, such as a firewall. For example, your Palo Alto Networks firewall can add IP addresses and domain data from the EDL to block or allow lists. Cortex XSIAM hosts the following external dynamic lists that you can configure and manage: * IP Addresses EDL * Domain Names EDL ### Configure an EDL Before you start, you must have a role that includes View/Edit EDL permissions, such as Instance Admin. If creating a custom role, select **View/Edit** for **EDL** (**Roles** → **New Roles** → **INVESTIGATION & RESPONSE** → **Response** → **EDL**). You can set up an EDL on the Cortex XSIAM tenant or an engine. {% hint style="info" %} * Configuring custom certificates or private API Keys in the EDL integration instance is supported only on engines, not on the Cortex XSIAM tenant. * For EDL integrations on the tenant, you must set a username and password. For long-running integrations running on an engine, we strongly recommend setting a username and password, but it is not required. You can set credentials for all EDL integrations or for a specific integration instance. * The legacy external dynamic list PAN-OS integration is deprecated. Use the EDL integration on the **Data Sources & Integrations** page (by clicking the **Automation & Feed Integration** link. {% endhint %} ### Configure the EDL in Cortex XSIAM 1. Navigate to **Settings** → **Configurations** → **Integrations** → **External Dynamic List Integration**. 2. Under **External Dynamic List Credentials**, enter a username and password. 3. In the **External Dynamic List - Generic Integration** section, click the link to configure the External Dynamic List integration. 4. Select the **Generic Export Indicators Service** integration and click **Add Instance**. 5. If you are using an engine, add the following: * **Listen Port:** The service to access the EDL runs on this port from within Cortex XSIAM. You need a unique port for each long running integration instance. Do not use the same port for multiple instances. * **Run on single engine:** Select the engine from a drop-down. 6. Enter the indicator query. The query updates the EDL list. To view expected results, run `!findIndicators query=` from the Cortex XSIAM CLI. Field names in your query must match the machine name for each field. 7. Enter the maximum list size.

If an indicator query returns more indicators than the EDL list size, the list is populated with the most recent indicators sorted by their last seen timestamp, where n is the maximum size of the EDL.

8. The EDL URL must always be prefixed by `ext-`.

If using EDL data on the Cortex XSIAM tenant, run the following curl command to access and test the External Dynamic List:

https://ext-<cortex-xsiam-address>/xsoar/instance/execute/<instance-name>

Example

curl -v -u user:pass https://ext-mytenant.paloaltonetworks.com/xsoar/instance/execute/edl_instance_01?q=type:ip

If using EDL data on an engine, run the following curl command to access and test the External Dynamic List with the engine URL:

http://<engine-address>:<integration listen port>/

Example

curl -v -u user:pass http://<engine_address>:<listen_port>/?n=50
### Configure the Firewall to authenticate the EDL 1. Enable the firewall to authenticate the EDL. * Download the following root certificate: . * On the firewall, select **Device** → **Certificate Management** → **Certificates** and import the certificate. Make sure to give the device certificate a descriptive name, and select **OK** to save the certificate. * Select **Device** → **Certificate Management** → **Certificate Profile** and **Add** a certificate profile. * Give the profile a descriptive name and add the certificate to the profile. * Select **OK** to save the profile. 2. Set the Cortex XSIAM EDL as the source for a firewall EDL. For more detailed information about how Palo Alto Networks firewall EDLs work, how you can use EDLs, and how to configure them, review how to Use an External Dynamic List in Policy. * On the firewall, select **Objects** → **External Dynamic Lists** and **Add** a new list. * Define the list **Type** as either **IP List** or **Domain List**. * Enter the IP Addresses Block List URL or the Domains Block List URL that you recorded in the last step as the list **Source**. * Select the **Certificate Profile** that you created in the last step. * Select **Client Authentication** and enter the username and password that the firewall must use to access the EDL. * Use the **Repeat** field to define how frequently the firewall retrieves the latest list from the Cortex XSIAM EDL. * Click **OK** to add the new EDL. 3. Select **Policies** → **Security** and **Add** or edit a security policy rule to add the Cortex XSIAM EDL as match criteria to a security policy rule. Review the different ways you can Enforce Policy on an External Dynamic List; this topic describes the complete workflow to add an EDL as match criteria to a security policy rule. * Select **Policies** → **Security** and **Add** or edit a security policy rule. * In the **Destination** tab, select **Destination Zone** and select the external dynamic list as the **Destination Address**. * Click **OK** to save the security policy rule and **Commit** your changes. You do not need to perform an additional commit or make any subsequent configuration changes for the firewall to enforce the EDL as part of your security policy, even as you update the Cortex XSIAM EDL, the firewall will enforce the list most recently retrieved from Cortex XSIAM.

You can also use the IP list and URL lists as part of a URL Filtering policy, or the domain list as part of a custom Anti-Spyware profile.

### Add an IP address or domain to your EDL You can add IP addresses or Domains to your EDL to raise your triage issues from the Action Center or throughout Cortex XSIAM. {% hint style="info" %} Ensure EDL sizes don't exceed your firewall model limit. {% endhint %} To add an IP address or Domain from the Action Center, select **Add to EDL**. You can choose to enter the IP address or Domain you want to add **Manually** or choose to **Upload File**. During investigation, you can also **Add to EDL** from the Actions menu that is available from investigation pages such as the Issues View, Causality View, or IP View. At any time, you can view and make changes to the IP addresses and domain names in the EDL. 1. Go to **Investigation & Response** → **Action Center** → **Currently Applied Actions** → **External Dynamic List**. 2. Review your IP addresses and domain names lists. 3. If desired, select **New Action** to add additional IP addresses and domain names. 4. If desired, select one or more IP addresses or domain names, right-click and select **Delete** any entries that you no longer want included on the lists. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/manage-external-dynamic-lists.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.