Automation out of the box, available directly on the firewall – Dynamic User Group and Dynamic Address Group. What it is about? Basically, using Palo Alto Networks firewall features, you can automatically add ip addresses or users to dynamic groups and enforce some actions, like blocking or allowing access to some resources. What are practical uses cases? It is always matter of specific environments and needs, so far I have implemented couple scenarios:
- block source ip address which is trying to scan infrastructure from internet
- quarantine host based on critical security event and send email
- configure access policies for newly provisioned VM, supported VMware, AWS, Azure and GCP, called VM Monitoring
Basically, configurations steps for every scenario are more or less similar. Let’s elaborate use case no 1, what are the building blocks and how to configure it.
First step, Dynamic Address Group configured under Objects -> Address Groups. Group membership type is dynamic and based on tag – in my case, source ip with tag WAN_THREAT_BLOCK will be member of DAG.
Second, security policies to block communication to/from DAG WAN_THREAT_BLOCK
Third, how to automatically tag specific source ip address? It’s based on Log Forwarding profile under Objects -> Log Forwarding. Log filter need to be developed to tag ip address based on event. In my case I’m looking into threat log for events generated by vulnerability and spyware security profiles with severities high, critical and medium.
(( subtype eq vulnerability ) and ( zone.src eq WAN ) and ( zone.dst eq WAN) and (( severity eq medium ) or (severity eq critical ) or (severity eq high ))) or (( subtype eq spyware ) and ( zone.src eq WAN ) and ( zone.dst eq WAN) and (( severity eq medium ) or (severity eq critical ) or (severity eq high ))) 
Under Built-in Action set up to tag source address with tag WAN_THREAT_BLOCK
Last building block, Log Forwarding profile defined on security policy rule which is hitting incoming traffic from internet
To verify if it’s working correctly, here you can find out that source ip addresses are added to DAG
Automatic actions have been enforced based on firewall itself, specifically it’s called auto-tagging. Exactly the same thing can be done via XML-API – for example, some analytical solution like SIEM/UEBA/SOAR can automatically enforce remediation actions.