External Dynamic List Objects

External Dynamic List (EDL) objects enable dynamic import of IP addresses, domains, URLs, and mobile identifiers from external sources in Strata Cloud Manager. The scm CLI provides commands to create, update, delete, show, backup, and load external dynamic list objects.

Overview

The external-dynamic-list commands allow you to:

Configure predefined threat intelligence feeds
Create custom EDLs with scheduled updates
Import IP addresses, domains, URLs, IMSI, and IMEI lists
Configure authentication for secure sources
Export EDLs for backup or migration

EDL Types

Predefined Lists

Palo Alto Networks managed threat feeds:

Type	Common URLs
predefined_ip	panw-bulletproof-ip-list
predefined_ip	panw-highrisk-ip-list
predefined_ip	panw-known-ip-list
predefined_ip	panw-torexit-ip-list
predefined_url	panw-malware-url-list
predefined_url	panw-phishing-url-list

Custom Lists

User-defined lists with flexible update schedules:

Type	Content	Format
ip	IP addresses	One per line, CIDR notation supported
domain	Domain names	One per line, wildcards supported
url	URLs	Full URLs, one per line
imsi	Mobile subscriber IDs	Numeric identifiers
imei	Mobile equipment IDs	Device identifiers

Set External Dynamic List

Create or update an external dynamic list object.

Syntax

scm set object external-dynamic-list NAME [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Name of the external dynamic list	Yes

Options

Option	Description	Required
`--folder TEXT`	Folder location	Yes*
`--snippet TEXT`	Snippet location	Yes*
`--device TEXT`	Device location	Yes*
`--type TEXT`	EDL type (predefined_ip, predefined_url, ip, domain, url, imsi, imei)	Yes
`--url TEXT`	Source URL for the list	Yes
`--description TEXT`	Description of the EDL	No
`--exception-list TEXT`	Item to exclude from the list (repeat for multiple)	No
`--username TEXT`	Username for basic authentication	No
`--password TEXT`	Password for basic authentication	No
`--certificate-profile TEXT`	Certificate profile for authentication	No
`--recurring TEXT`	Update frequency (five_minute, hourly, daily, weekly, monthly)	No**
`--hour TEXT`	Hour for updates (00-23)	No***
`--day TEXT`	Day for updates	No***
`--expand-domain / --no-expand-domain`	Expand to include subdomains (domain type only)	No

* Exactly one of --folder, --snippet, or --device is required.

** Required for custom EDL types (ip, domain, url, imsi, imei).

*** Required based on recurring frequency.

Examples

Create Predefined IP Blocklist

$ scm set object external-dynamic-list paloalto-bulletproof \
    --folder Texas \
    --type predefined_ip \
    --url "panw-bulletproof-ip-list" \
    --description "Palo Alto Networks Bulletproof IP list"
---> 100%
Created external dynamic list: paloalto-bulletproof in folder Texas

Create Custom IP List with Hourly Updates

$ scm set object external-dynamic-list custom-threats \
    --folder Texas \
    --type ip \
    --url "https://threats.example.com/ips.txt" \
    --recurring hourly \
    --description "Custom threat IP list"
---> 100%
Created external dynamic list: custom-threats in folder Texas

Create Domain List with Authentication

$ scm set object external-dynamic-list malware-domains \
    --folder Texas \
    --type domain \
    --url "https://secure.example.com/domains.txt" \
    --username "api_user" \
    --password "secure_token" \
    --recurring daily \
    --hour 02 \
    --expand-domain \
    --description "Malware domain blocklist"
---> 100%
Created external dynamic list: malware-domains in folder Texas

Delete External Dynamic List

Delete an external dynamic list object from SCM.

Syntax

scm delete object external-dynamic-list NAME [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Name of the external dynamic list object to delete	Yes

Options

Option	Description	Required
`--folder TEXT`	Folder location	Yes*
`--snippet TEXT`	Snippet location	Yes*
`--device TEXT`	Device location	Yes*
`--force`	Skip confirmation prompt	No

* Exactly one of --folder, --snippet, or --device is required.

Example

$ scm delete object external-dynamic-list custom-threats --folder Texas --force
---> 100%
Deleted external dynamic list: custom-threats from folder Texas

Load External Dynamic Lists

Load multiple external dynamic list objects from a YAML file.

Syntax

scm load object external-dynamic-list [OPTIONS]

Options

Option	Description	Required
`--file TEXT`	Path to YAML file containing external dynamic list definitions	Yes
`--folder TEXT`	Override folder location for all objects	No
`--snippet TEXT`	Override snippet location for all objects	No
`--device TEXT`	Override device location for all objects	No
`--dry-run`	Preview changes without applying them	No

YAML File Format

---
external_dynamic_lists:
  - name: paloalto-bulletproof
    folder: Texas
    type: predefined_ip
    url: "panw-bulletproof-ip-list"
    description: "Palo Alto Networks Bulletproof IP list"

  - name: office-ips
    folder: Texas
    type: ip
    url: "https://internal.company.com/office-ips.txt"
    description: "Office IP addresses"
    recurring: daily
    hour: "06"
    exception_list:
      - "10.0.0.0/8"
      - "172.16.0.0/12"

  - name: malware-domains
    folder: Texas
    type: domain
    url: "https://threat-intel.example.com/domains"
    description: "Known malware domains"
    username: "api_user"
    password: "secure_token"
    recurring: hourly
    expand_domain: true

Examples

Load with Original Locations

$ scm load object external-dynamic-list --file edls.yml
---> 100%
✓ Loaded external dynamic list: paloalto-bulletproof
✓ Loaded external dynamic list: office-ips
✓ Loaded external dynamic list: malware-domains

Successfully loaded 3 out of 3 external dynamic lists from 'edls.yml'

Load with Folder Override

$ scm load object external-dynamic-list --file edls.yml --folder Austin
---> 100%
✓ Loaded external dynamic list: paloalto-bulletproof
✓ Loaded external dynamic list: office-ips
✓ Loaded external dynamic list: malware-domains

Successfully loaded 3 out of 3 external dynamic lists from 'edls.yml'

note

When using container override options (--folder, --snippet, --device), all external dynamic lists will be loaded into the specified container, ignoring the container specified in the YAML file.

Show External Dynamic List

Display external dynamic list objects.

Syntax

scm show object external-dynamic-list [NAME] [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Name of the external dynamic list object to show; omit to list all	No

Options

Option	Description	Required
`--folder TEXT`	Folder location	Yes*
`--snippet TEXT`	Snippet location	Yes*
`--device TEXT`	Device location	Yes*
`--max-results INTEGER`	Maximum number of results to display	No
`--output [table\|json\|yaml]`	Output format (default: `table`)	No

* Exactly one of --folder, --snippet, or --device is required.

note

When no NAME argument is provided, all items are listed by default.

Examples

Show Specific External Dynamic List

$ scm show object external-dynamic-list custom-threats --folder Texas
---> 100%
External Dynamic List: custom-threats
  Location: Folder 'Texas'
  Type: ip
  URL: https://threats.example.com/ips.txt
  Recurring: hourly
  Description: Custom threat IP list
  ID: 123e4567-e89b-12d3-a456-426614174000

List All External Dynamic Lists (Default Behavior)

$ scm show object external-dynamic-list --folder Texas
---> 100%
External Dynamic Lists in folder 'Texas':
------------------------------------------------------------
Name: paloalto-bulletproof
  Location: Folder 'Texas'
  Type: predefined_ip
  URL: panw-bulletproof-ip-list
  Description: Palo Alto Networks Bulletproof IP list
------------------------------------------------------------
Name: custom-threats
  Location: Folder 'Texas'
  Type: ip
  URL: https://threats.example.com/ips.txt
  Recurring: hourly
  Description: Custom threat IP list
------------------------------------------------------------
Name: malware-domains
  Location: Folder 'Texas'
  Type: domain
  URL: https://secure.example.com/domains.txt
  Recurring: daily at 02:00
  Authentication: Basic (api_user)
  Expand Domain: Yes
  Description: Malware domain blocklist
------------------------------------------------------------

Backup External Dynamic Lists

Backup all external dynamic list objects from a specified location to a YAML file.

Syntax

scm backup object external-dynamic-list [OPTIONS]

Options

Option	Description	Required
`--folder TEXT`	Folder to backup external dynamic lists from	No*
`--snippet TEXT`	Snippet to backup external dynamic lists from	No*
`--device TEXT`	Device to backup external dynamic lists from	No*
`--file TEXT`	Output filename (defaults to auto-generated)	No

* One of --folder, --snippet, or --device is required.

Examples

Backup from Folder

$ scm backup object external-dynamic-list --folder Texas
---> 100%
Successfully backed up 8 external dynamic lists to external-dynamic-list_folder_texas_20240115_120530.yaml

Backup with Custom Filename

$ scm backup object external-dynamic-list --folder Texas --file texas-edls.yaml
---> 100%
Successfully backed up 8 external dynamic lists to texas-edls.yaml

Best Practices

Update Frequency: Balance freshness and resource usage -- critical lists every 5 minutes, standard lists daily.
List Validation: Ensure source URLs are reliable and properly formatted.
Exception Lists: Use exception lists for false positives or internal resources.
Authentication: Use HTTPS and authentication for sensitive lists.
Monitoring: Monitor EDL update status and failures regularly.
Use YAML for Bulk Operations: For complex deployments, use YAML files.
Organize by Container: Keep EDLs organized in appropriate folders, snippets, or devices.

Overview​

EDL Types​

Predefined Lists​

Custom Lists​

Set External Dynamic List​

Syntax​

Arguments​

Options​

Examples​

Create Predefined IP Blocklist​

Create Custom IP List with Hourly Updates​

Create Domain List with Authentication​

Delete External Dynamic List​

Syntax​

Arguments​

Options​

Example​

Load External Dynamic Lists​

Syntax​

Options​

YAML File Format​

Examples​

Load with Original Locations​

Load with Folder Override​

Show External Dynamic List​

Syntax​

Arguments​

Options​

Examples​

Show Specific External Dynamic List​

List All External Dynamic Lists (Default Behavior)​

Backup External Dynamic Lists​

Syntax​

Options​

Examples​

Backup from Folder​

Backup with Custom Filename​

Best Practices​

Overview

EDL Types

Predefined Lists

Custom Lists

Set External Dynamic List

Syntax

Arguments

Options

Examples

Create Predefined IP Blocklist

Create Custom IP List with Hourly Updates

Create Domain List with Authentication

Delete External Dynamic List

Syntax

Arguments

Options

Example

Load External Dynamic Lists

Syntax

Options

YAML File Format

Examples

Load with Original Locations

Load with Folder Override

Show External Dynamic List

Syntax

Arguments

Options

Examples

Show Specific External Dynamic List

List All External Dynamic Lists (Default Behavior)

Backup External Dynamic Lists

Syntax

Options

Examples

Backup from Folder

Backup with Custom Filename

Best Practices