Integrating Tier4Security Threat Intelligence with Palo Alto Firewalls Using EDLs
Blocking today’s threats requires more than static signatures and generic blocklists. Tier4Security’s curated threat intelligence is designed to plug directly into Palo Alto Networks firewalls via External Dynamic Lists (EDLs), giving security teams continuously updated, high-fidelity indicators without manual list management. Only indicators with a severity score of 90 or higher make it into the feed, helping reduce noise and false positives while focusing enforcement on truly malicious activity.Configuring-Palo-Alto-Firewalls-EDL-integration.pdf
Tier4Security hosts its threat intelligence in a secure repository that is only accessible to registered customers of the free Threat Intelligence service. After subscribing, customers receive a unique HTTPS feed URL that their firewall uses to periodically pull fresh Indicator of Compromise (IoC) data.
The Palo Alto EDL integration supports multiple indicator types from the Tier4Security feed:
IP addresses (IPv4/IPv6 and CIDR subnets) for blocking known bad hosts and networks.
Domain names (FQDNs) for disrupting command-and-control and phishing infrastructure, with PAN-OS enforcing them as a domain list.
URLs for more granular blocking of malicious paths and payload delivery, assuming a valid URL Filtering license is in place.
All content is formatted to PAN-OS requirements (plaintext, one entry per line), so no additional parsing or conversion is required on the customer side.
To use the integration, organizations need a PAN-OS firewall running version 7.1 or later, with 9.1+ recommended for improved list capacity and management. Access to the firewall’s web interface with administrator privileges is required, as is a certificate profile that trusts public certificate authorities so the device can securely connect to the Tier4Security repository over HTTPS.
Each customer must also maintain an active Tier4Security Threat Intelligence subscription and ensure that the firewall’s public IP address is registered; otherwise, the repository will reject connections and the EDL will fail to update. The secure feed URL is available from the Tier4Security User Portal under the “EDL Subscription Links” section and is unique to the subscribed user.
The integration process can be summarized in four main steps:
Retrieve the secure feed URL from the Tier4Security User Portal by copying the EDL subscription link corresponding to the desired list, such as a daily blocklist.
Create the External Dynamic List object in PAN-OS by navigating to Objects → External Dynamic Lists, adding a new list, selecting the appropriate type (IP or Domain), pasting the secure URL, attaching a trusted certificate profile, and setting an update interval as frequent as every five minutes.
Reference the EDL in a security policy by building a rule that uses the newly created list as the destination object and setting the action to Deny or Drop, with logging at session end enabled to provide visibility into blocked activity.
Commit the configuration so the firewall starts enforcing the policy and begins pulling entries from the Tier4Security repository on the defined schedule.
Once deployed, administrators can validate that the list is populating by viewing the “List Entries” in the GUI or by running a CLI command to display the downloaded indicators associated with the EDL.
A key differentiator of this integration is the way Tier4Security curates data before it ever reaches the firewall. Threat intelligence analysts manually review and score indicators, publishing only those with a severity score above 90, which helps ensure that the EDL represents a tightly focused blocklist rather than a broad, unfiltered feed. This approach is designed to give defenders higher confidence that a match indicates genuinely malicious activity, while minimizing the likelihood of blocking legitimate traffic.
In some 24‑hour periods, no indicators may reach the severity threshold. In these cases, Tier4Security will occasionally serve an empty list to explicitly signal an “All Clear” state, which PAN-OS handles gracefully without generating errors. The service team emphasizes that configuration guidance is provided for informational purposes only, and customers remain responsible for validating policy behavior and assessing operational risk before making changes in production.
If customers encounter issues such as HTTP 403 errors or connectivity failures, Tier4Security offers support via its secure portal and a dedicated support email address, requesting that users include their registered IP address to accelerate troubleshooting.
For more additional information please check this technical document for step by step instructions on how to configure EDL list on Palo Alto firewalls.
