Palo Alto Networks Certified Network Security Engineer (PCNSE)Manage and OperateEasy
A security analyst is investigating a suspected malware infection originating from an internal host. The analyst needs to quickly determine if the host has communicated with known malicious IP addresses or domains. Which type of external service integration would provide the most direct and real-time threat intelligence for this investigation within the Palo Alto Networks firewall?
- ANetFlow collector for traffic analysis.
- BExternal Dynamic Lists (EDLs) for threat feeds.
- CSNMP trap receiver for alert notifications.
- DSyslog server integration for log forwarding.
Show answer & explanationAnswer & explanation
Correct answer: B. External Dynamic Lists (EDLs) for threat feeds.
External Dynamic Lists (EDLs) allow the firewall to consume threat intelligence feeds (lists of malicious IPs, URLs, or domains) from external sources. These lists can then be directly used in security policies to block or monitor traffic to/from known bad actors in real-time.
Why the other options are wrong
- A. NetFlow collectors gather flow data for analysis, which is useful for post-incident investigation but does not provide real-time policy enforcement based on threat intelligence.
- C. SNMP traps send alerts, which are reactive notifications, not proactive threat intelligence used in policies.
- D. Syslog servers collect logs, which can be analyzed, but don't provide real-time blocking based on threat intelligence directly within the firewall policy.
External Dynamic Lists (EDLs)
A feature in Palo Alto Networks firewalls that enables the firewall to import and dynamically update lists of IP addresses, URLs, or domains from external sources, which can then be used in security policies.
- Consumes threat intelligence feeds.
- Dynamically updates lists of indicators of compromise (IOCs).
- Used directly in security policies for real-time enforcement.
Memory trick: EDLs: External Dynamic Lists for Direct Live Blocking.