---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Check and Block Value Workflow

# Security Operations Palo Alto Networks - Check and Block Value Workflow {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 min. de leitura

As security incidents are created and triaged to identify potential threats, you can use the Security Operations Palo Alto Networks - Check and Block Value workflow to automatically check and update IP
addresses, URLs, and domains using External Dynamic Lists defined in Palo Alto Networks - Firewall.

## Antes de Iniciar

Role required: sn_si.analyst

## Por Que e Quando Desempenhar Esta Tarefa

The Security Operations Palo Alto Networks - Check and Block Value workflow is executed when Firewall Block Requests are submitted. The block request specifies the firewall to be used, the type of observable to be checked and blocked (if needed), and the block value. That is, the IP address, URL, or domain in question.

During workflow execution, commands defined under Palo Alto Networks IntegrationFirewallCommands are run. The Show type commands (for example, Show-IP-ExternalDynamicList) determine whether the value exists on the firewall. The Refresh type commands (for example, Refresh-IP-ExternalDynamicList) add value that
do not exist on the firewall to the block list.

After the [Blocked Status](https://servicenow-prod.fluidtopics.net/3mCof37K0PQL9tmNZyUfmw#fw-blocked-status-activity "This activity checks if the value (IP, URL, or domain) is included in its respective External Dynamic List/Dynamic Block List (EDL/DBL) on firewall. The EDL/DBL details are obtained from the firewall using an operational command, and a routine is performed to check if the value is blocked on the firewall.") activity executes, approval by a system administrator is required before the workflow can proceed.
Figura 1. Security Operations Palo Alto Networks - Check and Block Value workflow

## Procedimento

1. Navigate to Palo Alto Networks IntegrationFirewallBlock Requests.
2. Click New.
3. Fill in the fields on the form, as appropriate.  
   {#check-and-block-values__table_vks_thr_ns__entry__2}

   | Field | Description |
   |-|-|
   | Firewall | Select the firewall to be used. |
   | Block Type | Select the type of value to be checked: * IP * URL * DOMAIN {#check-and-block-values__ul_dg2_x52_zw} |
   | Block Value | Enter the value of the selected type to be checked on the firewall. |
   [ ]

   {#check-and-block-values__table_vks_thr_ns}
4. Click Submit.

## Palo Alto Firewall- Block Request Status activity {#ariaid-title2}

This activity is called by other activities to set the Firewall block request status to
success or failure.

### Input variables

Input variables determine the initial behavior of the activity.
{#fw-block-request-status-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| firewallBlockRequestSysid \[string\] | The system id of the firewall block request. This input variable is mandatory. |
| status \[string\] | Indicates whether the refresh job ran: success or failure. |
[Tabela 1. Input variables]

{#fw-block-request-status-activity__table_pgm_tfy_jr}

### Output variables

The output variables contain data that can be used in subsequent activities. The output
consists of data from the firewall configuration, as well as dynamically generated data.
{#fw-block-request-status-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| result \[string\] | Indicates whether the success or failure of the refresh job. |
[Tabela 2. Output variables]

{#fw-block-request-status-activity__table_bnj_jfy_jr}

## Palo Alto Firewall- Block Value activity {#ariaid-title3}

After the workflow has identified a value that is not on the firewall, the record is
routed for approval. Upon approval, this activity connects to the MID Server via your SSH
credentials and invokes a script that adds the value to the firewall External Block List.

### Input variables

Input variables determine the initial behavior of the activity.  
Nota:  
You must manually enter the input variables for this activity and then [publish the workflow](https://www.servicenow.com/docs/access?context=work-on-workflows&version=australia&pubname=australia-build-workflows&ft:locale=en-US). If the workflow is not published, the input variables will not be saved for non-admin users.
{#fw-block-value-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| toBeBlockedValue \[string\] | The value to be added to the EDL if not already present. This input variable is mandatory. |
| typeToBeBlocked \[string\] | The type of value to be blocked: IP, URL, or Domain. This input variable is mandatory. |
| targetHost \[string\] | The MID Server on which the script is executed. |
| SSHCredentialTag \[string\] | The [SSH credential tag defined on the MID server](https://servicenow-prod.fluidtopics.net/ompX~qZIwS3ijWV54pY3KQ "Palo Alto Networks Firewall sends API calls to the MID Server. As such, ensure that SSH credentials have been created for the MID Server."). |
| scriptCommand \[string\] | The AppendValueToList.sh script used to add the value to the EDL. It requires the full path to the MID Server. |
[Tabela 3. Input variables]

{#fw-block-value-activity__table_pgm_tfy_jr}

### Output variables

The output variables contain data that can be used in subsequent activities.
{#fw-block-value-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| result \[string\] | The result passed to the EDL. |
[Tabela 4. Output variables]

{#fw-block-value-activity__table_bnj_jfy_jr}

## Palo Alto Firewall- Blocked Status activity {#ariaid-title4}

This activity checks if the value (IP, URL, or domain) is included in its respective
External Dynamic List/Dynamic Block List (EDL/DBL) on firewall. The EDL/DBL details are
obtained from the firewall using an operational command, and a routine is performed to check if
the value is blocked on the firewall.

### Input variables

Input variables determine the initial behavior of the activity. All input variable entries
listed are mandatory.
{#fw-blocked-status-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| valueToBeChecked \[string\] | The value in the block request. |
| showEDLDetailsCommand \[string\] | The External Dynamic List command being used to determine whether the value exists on the firewall. |
| FirewallIpAddress \[string\] | The IP address of the firewall used. |
| FirewallApiKey \[string\] | The firewall API key. |
[Tabela 5. Input variables]

{#fw-blocked-status-activity__table_pgm_tfy_jr}

### Output variables

The output variables contain data that can be used in subsequent activities. The output
consists of data from the firewall configuration, as well as data dynamically generated
using the Palo Alto Firewall Operational Command API message.
{#fw-blocked-status-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| commandResult \[string\] | The results from the firewall for the show EDL Details command. |
| blockedStatus \[Boolean\] | True indicates blocked. False indicates not blocked. |
| commandResponse \[string\] | The response status obtained from the firewall for the show EDL Details Command. |
[Tabela 6. Output variables]

{#fw-blocked-status-activity__table_bnj_jfy_jr}

## Palo Alto Firewall: Get API Key Action {#ariaid-title5}

This action retrieves the API key from the firewall.

### Input variables

Input variables determine the initial behavior of the action. All input variable entries listed are mandatory.
{#fw-get-api-key-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| Username \[string\] | The user name of the firewall administrator. |
| Password \[string\] | The firewall administrator password. |
| FirewallIpAddress \[string\] | The IP address of the firewall. |
[Tabela 7. Input variables]

{#fw-get-api-key-activity__table_pgm_tfy_jr}

### Output variables

The output variables contain data that can be used in subsequent actions. The output consists of data from the firewall configuration, as well as dynamically generated data.
{#fw-get-api-key-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| APIKey \[string\] | The firewall API key. |
[Tabela 8. Output variables]

{#fw-get-api-key-activity__table_bnj_jfy_jr}

## Palo Alto Firewall: Get Firewall Config Action {#ariaid-title6}

The Palo Alto Firewall: Get Firewall Config flow action gets all the related firewall configuration information from the database, and makes it available for use by the subsequent action.

### Input variables

Input variables determine the initial behavior of the action.
{#fw-get-config-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| firewallSysid \[string\] | The system id of the firewall. This input variable is mandatory. |
| typeOfValueToBeBlocked \[string\] | The type of value to be blocked on the firewall: IP, URL, or Domain. |
| firewallIPAddress \[string\] | The IP address of the firewall. |
[Tabela 9. Input variables]

{#fw-get-config-activity__table_pgm_tfy_jr}

### Output variables

The output variables contain data that can be used in subsequent actions. The output consists of data from the firewall configuration, as well as dynamically generated data.
{#fw-get-config-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| ipEDLName \[string\] | The External Dynamic List name for IP addresses. |
| urlEDLName \[string\] | The External Dynamic List name for URLs. |
| domainEDLName \[string\] | The External Dynamic List name for domains. |
| firewallVersionSysId \[string\] | The system id for the firewall version. |
| refreshEDLCommand \[string\] | The command to be used to refresh the EDL from the source. |
| ShowEDLDetailsCommand \[string\] | The command to be used to get the EDL details. |
| status \[Boolean\] | True indicates success. False indicates failure. |
| error \[string\] | The error, if any, that occurred in the action. |
| endpoint \[Encrypted\] | The encrypted endpoint from the database. |
[Tabela 10. Output variables]

{#fw-get-config-activity__table_bnj_jfy_jr}

## Palo Alto Firewall- Refresh EDL/DBL activity {#ariaid-title7}

This activity executes an operational command on the firewall to refresh the External
Dynamic List from the source configured on the firewall. The output of this activity indicates
whether the Refresh job has been queued up.

### Input variables

Input variables determine the initial behavior of the activity. All input variable entries
listed are mandatory.
{#fw-refresh-edl-dbl-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| FirewallIpAddress \[string\] | The IP address of the firewall being refreshed. |
| FirewallApiKey \[string\] | The refreshed firewall API key. |
| FirewallCommand \[string\] | The operational command to be executed to queue up the refresh job. |
[Tabela 11. Input variables]

{#fw-refresh-edl-dbl-activity__table_pgm_tfy_jr}

### Output variables

The output variables contain data that can be used in subsequent activities. The output
consists of data from the firewall configuration, as well as dynamically generated data.
{#fw-refresh-edl-dbl-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| activity.Output.result \[string\] | A text string to indicate whether refresh job was queued to run: success or failure. |
[Tabela 12. Output variables]

{#fw-refresh-edl-dbl-activity__table_bnj_jfy_jr}