Create Custom Feeds
To export threat intelligence data generated
from AutoFocus and other Palo Alto Networks connected services,
you must create custom feeds, which organize data into a specific,
user-defined set that can be output into URL lists or EDLs.
User-defined
feeds can retrieve a maximum of 100,000 IPv4 indicators or 5,000
indicators of all other types, per request. As a best practice, specify
a frequency in which the firewall (or any other third party consumer
of threat indicators, such as a TIP or SIEM) retrieves a feed list
at a corresponding rate to which the indicators are produced. If
the number of indicators in a feed list exceed the rate at which
they can be retrieved, it is possible that not all of the indicators
will be consumed. Alternatively, consider creating multiple feeds
with more specificity to generate a manageable number of indicators
per query. This allows you to better organize and control the type
of threat indicators sent to an EDL or URL list.
- SelectFeedson the navigation pane and then selectCreate a Feed.
- Select an indicator type and search conditions to define the limits of a search and clickNextto continue. Depending on the indicator type, you might have predefined values or the option to enter an exact value. You can change the scope of your indicator query by adding or removing (
)conditions.
For a preview list, click Search. This displays a list based on the search conditions you have defined.
- Configure the custom feed details.You cannot create a custom feed using duplicate query conditions.
- Provide aNameandDescription. The name and description must be at least three and ten characters in length, respectively.
- Select the output method:
- URL—Provides a standard custom URL list for use with third-party applications and devices.
- EDL—Provides an external dynamic list to be used with the Palo Alto Networks firewall.
- (EDL Feeds Only) Select an indicator type.
- (EDL Feeds Only) Specify theEDL Feed Authenticationusername and password.
- Verify that all the entries are correct andSaveto continue.
- After the custom feed is created, a link to the object appears at the bottom of the page. Click on theFeed URLto view the results, otherwise clickExitto return to theCustom Feedsoverview page.
