Dynamic IP Blocking with Palo Alto Networks Firewalls and Censys

A practical guide to operationalize Censys Threat Hunting data into a continuously updated Palo Alto Networks External Dynamic List (EDL). The report includes prerequisites, a reference Python fetcher and lightweight HTTP server (Flask) to generate ips.txt, PAN‑OS EDL setup (web UI and CLI), scheduling and reliability tips (systemd/cron), tuning and safety valves to avoid overblocking, and troubleshooting and security considerations for running the service in production.