---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Working with block lists

# Working with block lists {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The ServiceNow
Check Point Next Generation Threat Prevention Integration supports Block Lists that accept IP, URL,
and Domain observables.

ServiceNow configured block list is a csv file that is hosted on an
external web server, which for this integration is the ServiceNow AI Platform instance. Custom Intelligence
Feed is configured on the Check Point Gateway, which pulls the IP addresses, URLs, and domains
from the ServiceNow AI Platform at pre-configured interval.

This integration supports three types of Block Lists:

* IP Address (This includes an individual IP Address (IPv4 only) for block list, and CIDR blocks (ranges) of addresses for allow list).
* URL
* Domain

{#working-with-block-lists__ul_pfh_jyv_pgb}

## Observables supported by the Check Point NGTP integration {#working-with-block-lists__section_wgy_kyv_pgb}

The section lists descriptions of the observables supported by this integration and example
formats for each type.
{#working-with-block-lists__table_zyj_ssb_qgb__entry__3}

| Observable Type | Examples | Description |
|-|-|-|
| Domain | * example.com * mail.example.com {#working-with-block-lists__ul_dxt_ltb_qgb} | Wildcards are not supported. |
| IP Address | 95.153.103.54 (IPv4) | Represents a single, distinct interface address. The integration supports only IPv4 and CIDR formats (CIDR format is only supported for allow listing purpose). For allow list purpose, integration has support for IP address observables includes CIDR (Classless Inter-Domain Routing) ranges, for example, 95.153.100.0/22. Note: An error message is displayed when you try to attach a single IP address to a Block List that you have already allowed listed as a part of a CIDR range. For example, the single address 95.153.103.54 is part of the CIDR range represented by 95.153.100.0/22 (95.153.100.0-95.153.103.255). |
| URL | * https://www.example.com * http://www.example.com {#working-with-block-lists__ul_l3r_ctb_qgb} | Description - The HTTPS URL are formatted by the application to trim the path from the URL and retain the domain name only. Check Point NGTP relies on HTTP CONNECT request to evaluate the web traffic and enforce blocking. For HTTPS CONNECT request, the entire URL isn't visible in the request and only domain name is visible. When a user blocks any HTTPS URL with specific path (example; https://www.example.com/path), the application trims the path automatically (www.example.com). The application maintains the relationship between original observable and the formatted URL. Below is the screenshot of Block List Entry which shows the formatted URL and the original observable. |
[ ]

{#working-with-block-lists__table_zyj_ssb_qgb}

For HTTP URLs with a specific path (for example, http://www.example.com/path), Check Point
would block the specified URL as the entire URL is visible in CONNECT request.