Talk an Expert⚡ Try For Free
← Back to integrations
FIREWALL

Palo Alto

Trusteed integrates with Palo Alto firewalls to sync dynamic blocklists, blocking attacker IPs and reducing SIEM noise in real time.

Prerequisites

  • A Palo Alto firewall that supports External Dynamic Lists (EDL).
  • A Trusteed account with access to the Noise-Aware IP blocklist feed.

Setup Steps

  1. Log in to your Trusteed Console.
  2. Navigate to Integrations → Firewalls → Palo Alto.
  3. Click Connect under the Palo Alto logo and assign a unique integration name.
  4. Copy the credentials (displayed once) for configuring your Palo Alto firewall.
  5. On your Palo Alto device, go to Objects → External Dynamic Lists → Add.
  6. Enter the Trusteed feed URL using your credentials:

https://<username>:<password>@api.trusteed.io/v1/integrations/<integration_id>/content

  1. Create a Security Policy:
    • Source tab: select your zone and the new dynamic list.
    • Action tab: set action to Drop and enable logging.
  2. Commit the policy.

Blocklist Format Example

Plain text format, one IP per line:

192.168.38.187
192.168.38.186

Outcome

  • Known attacker IPs blocked automatically by Palo Alto firewalls.
  • SIEM and SOAR pipelines see fewer false positives.
  • Analysts save time while targeted attacks are stopped at the perimeter.

Next Steps

  • Explore Trusteed’s Blocklist Catalog for more feeds.
  • Combine Palo Alto enforcement with SIEM/SOAR integrations.
  • Automate playbooks with enriched intelligence from Trusteed.

‍

‍