Before
Security teams periodically downloaded threat feeds, extracted the relevant hostnames, reformatted the data, and applied the changes to firewall rules. The process required switching between tools and was often performed infrequently because each update involved several manual actions.
How it works
- On a recurring schedule, retrieve the latest active malicious-hostname feed and extract the relevant domains.
- Retrieve the existing firewall lists, identify the "Hostnames blacklist" target, and format the domains for that list.
- Replace the target blacklist with the refreshed hostname set so scheduled threat intelligence updates are applied without analyst intervention.
Workflow details
- Scheduled collection: On a recurring schedule, the workflow downloads the latest DNS Response Policy Zone containing active malicious hostnames from URLHaus.
- Domain extraction: It parses the feed to identify hostname entries and removes the surrounding record details so only the relevant domains continue through the process.
- List preparation: The extracted hostnames are converted into the object format required by the firewall's existing Zero Trust list structure.
- Target validation: The workflow retrieves the available Zero Trust lists and selects the list named "Hostnames blacklist" as the update target.
- Blacklist replacement: The target list is fully updated with the refreshed hostname set, keeping the firewall's malicious-host coverage aligned with the latest scheduled feed retrieval.
What changed
The blacklist is now refreshed automatically on each scheduled cycle, including feed retrieval, hostname extraction, target-list selection, formatting, and full list replacement. Analysts no longer need to perform the update sequence manually, while the firewall list remains subject to the configured schedule.
Work removed
Manually downloading threat feeds, extracting hostnames, reformatting domain data, locating the target firewall list, and applying blacklist updates across tools.
Expected outcome
An estimated 4–6 manual actions are removed per blacklist update, with coverage refreshed on every configured schedule rather than only during periodic manual update sessions.
