Palo Alto NGFW

The URL

The blocklist endpoint returns one IPv4 per line with a comment header, which is exactly the External Dynamic List format. Firewalls cannot usually send a custom header, so the key goes in the query string.

https://ctif.orvteam.com/api/blocklist?format=txt&min_score=70&limit=50000&key=YOUR_API_KEY

That URL contains your key. Treat it as a credential: it is not secret once it is in a firewall config that other teams can read, and you can rotate it from Settings at any time.

Configure

1. 1Objects, External Dynamic Lists, Add. Give it a name such as CTIF-hostile-ip.
2. 2Type: IP List. Source: the URL above.
3. 3Check for updates: hourly is a good default; the feed itself is refreshed several times a day.
4. 4Certificate Profile: one that trusts a public certificate authority, so the firewall validates our TLS certificate rather than skipping it.
5. 5Commit, then use Test Source URL and List Capacity to confirm the firewall fetched entries.
6. 6Reference the list as the source in a security policy rule with action Deny, and log at session start.

Sizing and threshold

Every PAN-OS model has a maximum number of EDL entries. Set limit= below that number, and use min_score to decide what earns a block: 70 and above is a confident default, 50 is broader, 85 and above is close to certain. Entries fade out on their own as their score decays, so a list built at a threshold shrinks when the evidence gets old.