Synchronize Your Source

Use a Git Account to Synchronize Your Source

1. Login to Strata Cloud Manager.
2. Select Configuration > NGFW & Prisma Access > Setup.
3. Select the Hosted Dynamic Lists card on the Setup page; click the configuration icon.
4. In the Hosted Dynamic Lists page, select the Git Repositories tab to add a Git account.
5. Select the Git Accounts tab. This page displays currently connected Git accounts; you can use this page to view details about a connected account; you can also use this view to remove an account.
6. Click Add Git Account. In the Add Git Account page:

   1. Use the drop-down to select the Provider (GitHub or GitLab).
   2. Enter a Name.
   3. Enter a Description.
   4. Enter your Personal Access Token.
   5. Click Save.

      A Github personal access token is required to sync your Git account.

Use a Git Repository to Synchronize Your Source

1. In the Hosted Dynamic Lists page, select the Git Repositories tab to manage reusable credentials for Git hosting providers. Use this tab to view existing connected repositories, or to add a new one.
2. Click Add Git Repository. This page displays currently connected Git repositories; you can use this page to view details about the repository; you can also use this view to remove a repository. In the Add Git Repository page, use the drop-down to select the Git Account (GitHub or GitLab), or, click Create New.

   1. Enter a Name and (optionally) a Description for the Git account.
   2. Use the drop-down to select the EDL Type: IP list, Domain list, or a URL list.
   3. Optionally enter the Polling Interval (in minutes).
   4. Enter the Repository URL.
   5. Select the Branch.
   6. Specify the File Path.
   7. Click Save.
   8. Set the Source Type to Git Repository.
   9. Select your endpoint from the drop-down list.
   10. Click Save.

Use an API Endpoint

1. In the Hosted Dynamic Lists page, select the API Endpoints tab. This page displays associated endpoints. You can select an existing entry to edit it.
2. Click Add API Endpoint. In the Add API Endpoint screen:

   1. Enter a Name and Description for the API endpoint.
   2. Use the drop-down to select the EDL Type.
   3. Enter the Base URL for the API endpoint. This field represents the full URL of the REST endpoint that returns your threat data.
   4. Determine the Authentication Type.
   5. Select the Key Location: Header sends the key as a request header, Query appends it as a URL query parameter. Provide the Header Name to represent the name of the header or query parameter (for example, X-Apikey, api_key). Provide the Secret for the API key value.
   6. Select Test Source Connection to verify reachability and authentication. There are three states: Loading (connecting to the endpoint), Success (the endpoint is reachable and the credentials are valid), Error (the connection failed; review the URL and credentials before proceeding).
   7. Click Save. The new endpoint appears in the API Endpoints section, containing the Name, Base URL and Authentication Type.

      SCM will begin polling the endpoint on its scheduled (minimum every 5 minutes) and automatically processes the response into your hosted feed.

      To edit or delete an endpoint:

      • Edit: Click the endpoint name in the grid to reopen the pre-populated form.
      • Delete: Select the row checkbox → click Delete → confirm in the dialog.

      An API endpoint cannot be deleted while it is attached to a Hosted Dynamic List. Remove it from all lists first, then delete.

Use an Uploaded List

TXT — simplest, recommended
One entry per line. Lines starting with # are comments and are skipped. Inline tags are supported after # on entry lines.
# SOC blocklist - maintained by security team
10.0.0.1
192.168.5.0/24
203.0.113.0/24
10.0.0.5 # incident_id=inc123; severity=high
*.malware.example.com
https://phishing.example.com/payload # threat_type=phishing

CSV — if your data comes from a spreadsheet or tool export
By default, entries are read from the first column (index 0) and the first row is treated as a header.
ip_address,incident_id,severity
10.0.0.1,inc123,high
192.168.1.0/24,inc456,medium
203.0.113.0/24,inc789,low
If your IP or domain is in a different column, note the zero-based column index — you may be asked for this when configuring the source.

JSON — flat array
["10.0.0.1", "192.168.1.0/24", "203.0.113.0/24"]
Or nested objects (you will need to provide a JSONPath expression to extract values):
[
 {"ip": "10.0.0.1", "severity": "high"},
 {"ip": "192.168.1.0/24", "severity": "medium"}
]

1. In the Hosted Dynamic Lists page, select the Uploaded Lists tab. Use this tab to view existing lists, or to add a new one.

   An uploaded list cannot exceed 8MB.

   Select an uploaded list to view its contents (including the name, an optional description, and the configured data type (for example, IP list).
2. Click Add Uploaded Lists. In the Add Uploaded List page:

   1. Enter a Name and (optionally) Description for the uploaded list.
   2. Use the drop-down to select the EDL Type.
   3. Browse for the file (or drag and drop).

   SCM processes the file immediately and includes its entries in the hosted feed.

   Updating an Uploaded List

   When your data changes, upload a new file to replace or extend the existing list:

   1. Go to the Uploaded Lists tab.
   2. Click the list name to open the edit form.
   3. Drag and drop or browse to your new file.
   4. Click Save

   The hosted dynamic list feed is automatically regenerated with the updated entries.

   Editing or Deleting an Uploaded List

   • Edit: Click the list name in the grid to reopen the pre-populated form.
   • Delete: Select the row check box → click Delete → confirm in the dialog