HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Integrations / Palo Alto Networks

HoneyLabs blocklist as a Palo Alto external dynamic list

PAN-OS reads an external dynamic list from a URL on a schedule and lets a Security policy rule use it as an address object. An IP list must hold a single address, range or subnet on every line, which is what the HoneyLabs plain-text feed returns.

These steps follow Palo Alto Networks' documentation. We have not run them on a firewall ourselves, so start with a rule that logs.

  1. 01

    Save a query

    Sign in (free) and save the HoneyLabs query you want the feed to track on the feeds page. Any lookup query works: a port, an ASN, a tag, or a boolean combination. The feed returns the source IPs currently matching it, so a tighter query means a tighter blocklist.

    # Example saved queries and what they feed you
port:22 AND NOT tag:scanner     # SSH brute-forcers, known researchers removed
tag:scanner                     # every recognized scanner IP
cve:CVE-2024-4577               # IPs probing one specific CVE
asn:14061 AND port:445          # SMB scans out of DigitalOcean
  2. 02

    Mint a feed token

    On the same page, mint a feed URL for the saved query. The token alone authorizes the fetch: no cookies, no headers, safe to paste into an appliance. Give every consumer its own token so you can revoke a leaked URL without breaking the others.

    # Your feed URL looks like
https://honeylabs.net/feed/<token>        # plain text, one IP per line
https://honeylabs.net/feed/<token>.csv    # ip,first_seen,last_seen,events,asn,country
https://honeylabs.net/feed/<token>.json   # same fields as JSON
  3. 03

    Create the external dynamic list

    Under Objects > External Dynamic Lists, add a list of type IP List with the feed URL as its source. The firewall retrieves it every five minutes by default; hourly is enough for this feed. Test Source URL confirms the firewall can reach it.

    Objects > External Dynamic Lists > Add
Name              : HoneyLabs-Attackers
Type              : IP List
Source            : https://honeylabs.net/feed/<token>
Check for updates : Hourly
  4. 04

    Use it in a Security policy rule

    Add a rule above your allow rules with the list as its source address and the action set to deny, then commit. Entries count against the firewall's limit only once a rule uses the list.

    Policies > Security > Add
Source Address : HoneyLabs-Attackers
Destination    : any
Action         : Deny
Log at Session End : checked

Worth knowing

  • The maximum number of entries depends on the firewall model. When a list exceeds it, PAN-OS logs a system event and skips the rest, so keep the saved query narrow on small models.
  • Import Now on the list retrieves it at once after you change the saved query.
  • Source: Palo Alto Networks' documentation, "Policy Object: External Dynamic Lists".

The feed comes as a plain list of IPs, as CSV or as JSON. Any token can be revoked without touching the others, and responses are edge-cached for five minutes, so a tight refresh schedule costs nothing. Create yours on the feeds page, or browse the other integrations.