Palo Alto Networks

Palo Alto threat intelligence

Add Palo Alto threat intelligence to your NGFW as curated IP, URL and domain feeds. Known-bad indicators are blocked at the edge, alongside your existing Palo Alto subscriptions. For External Dynamic Lists, use the setup guide.

Get started for free Palo Alto setup guide
  • 2,500+Intelligence sources
  • 20 minFastest update interval (Premium)
  • 5 minTo full integration
  • 100%Made in Europe
What it is

What is the Q-Feeds and Palo Alto integration?

The Q-Feeds integration adds curated cyber threat intelligence to your Palo Alto Networks Next-Generation Firewall using native External Dynamic Lists (EDLs). PAN-OS periodically fetches Q-Feeds blocklists of malicious IP addresses, domains and URLs over HTTPS and enforces them directly in your Security policy rules.

Because the EDLs update automatically, known-bad indicators are blocked at the network edge before they reach your users or servers, with no manual list management. Q-Feeds runs alongside your existing Palo Alto and WildFire subscriptions to add independent, multi-source threat intelligence.

From a single PA-Series firewall to a Panorama-managed estate, the integration scales from a free proof of concept to full production use.

Benefits

Why add Q-Feeds to your firewall

  • Enhanced threat detection

    Cross-reference threat information to reduce false positives and identify genuine threats more effectively.

  • Updated every 20 minutes on Premium

    Your firewall stays ahead of the latest threats with intelligence refreshed every 20 minutes on Premium.

  • Increased resilience

    Rely on multiple sources for continuous protection and reduce the risk of blind spots in your security.

  • Improved incident response

    Faster, more precise response right on the edge of your network, saving time on internal investigations.

How it works

The Multi-Eyed Principle

The Multi-Eyed Principle emphasises using multiple sources of threat intelligence to strengthen the security and effectiveness of your existing firewall. By combining diverse feeds you achieve a more comprehensive, robust defence against cyber threats.

Multiple sources of IOCs

Commercial, OSINT and governmental intelligence combined in one firewall.

Simple 4-step implementation

Implementation is fast and easy with our 4-step manuals, and a proof of concept is completely free.

One set to rule them all

One threat intelligence set to rule them all

Cybersecurity companies are essentially data-processing companies: to block something, first you need to know what to block. By combining knowledge from many different vendors, you get the threat intelligence set to rule them all.

Implementation

Implementation

Implementation is a breeze thanks to our native support for the Palo Alto Next Generation Firewall. We've created convenient manuals for every use case, so your firewall can be hardened in no time.

Palo Alto setup guide
Custom project

Have a custom project?

Want to use our threat intelligence in a custom way? Get in touch and we will find a way to make it work.

Get started
Setup

How to add third-party threat intelligence to Palo Alto in 4 steps

  1. Create your free account

    Sign up on the Q-Feeds Threat Intelligence Portal and copy your personal feed URLs for IP, URL and domain indicators.

  2. Add an External Dynamic List

    In PAN-OS, go to Objects, External Dynamic Lists and create an IP, Domain or URL list that points to your Q-Feeds feed URL.

  3. Set the update interval

    Choose how often the firewall checks the list, commit the change and confirm the EDL imports entries successfully.

  4. Enforce in a Security policy

    Reference the EDL in a Security policy rule to block traffic to and from malicious IPs, domains and URLs immediately.

Palo Alto setup guide
More integrations

Threat intelligence feeds

Curated IP, URL and domain feeds for your whole stack.

Fortinet

Add IP, URL and domain threat feeds to your FortiGate with native External Connectors.

Sophos XGS

Enhance the Sophos XGS firewall with our threat intelligence.

OPNsense

Enhance OPNsense with our intelligence using the native plugin.
FAQ

Frequently asked questions about the Palo Alto integration

What is a Palo Alto External Dynamic List (EDL)?

An External Dynamic List is a PAN-OS object that automatically imports a list of malicious IPs, domains or URLs from an external source such as Q-Feeds, so you can reference it directly in your Security policy.

Which threat feeds can I add to my Palo Alto firewall?

With Q-Feeds you can add IP address, domain and URL threat feeds and enforce them in Security policy rules, URL filtering and DNS Security workflows.

How often are the Q-Feeds threat feeds updated?

The feeds are refreshed every 20 minutes on Premium, so your firewall always enforces current threat intelligence without any manual updates.

Does it work with Panorama and existing subscriptions?

Yes. You can push External Dynamic Lists from Panorama to managed firewalls, and Q-Feeds runs alongside your existing Palo Alto and WildFire subscriptions for broader coverage.

Is there a free version?

Yes. The Q-Feeds Community edition is free and lets you test the Palo Alto integration before upgrading to Plus or Premium for faster, premium intelligence.

Evaluate our intelligence today!

Simplify your security operations, start your free Q-Feeds trial and experience the difference.

Activate free access