---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Approve EDL entries for Palo Alto Networks

# Approve EDL entries for Palo Alto Networks {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Approving External Dynamic List (EDL) entries is part of the pre configuration. You must approve the EDL entries before the entries are activated on EDLs for the firewall to retrieve the entry and apply the security
policy.

## Before you begin

Role required: sn_sec_tisc.admin

## About this task

When the approval process is enabled, an EDL entry is not activated or deactivated on the EDL until it is approved.

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security CenterThreat Analyst Workbench.
2. Drill down to PAN NGFW section and select the EDL record for approval.
3. Go to My Approvals.
4. Select the EDL record(s) for approval.
5. Click Approve.
6. Under My Approval requests, click an item in the State column to open it.
7. Choose the option for approving the EDL entry.

   | Option | Description |
   | Approve | On the entry record, the Status field changes to Added, and the Active check box is selected. The Deactivate button is displayed and active. Work notes show that the request for the EDL entry has been approved. |
   | Reject | On the entry record, the Status field changes to Rejected, and the Active check box is cleared indicating the entry is not blocked on the firewall. Work notes show that the request for the EDL entry has been rejected. |
   |-|-|

   {#tisc-approve-edl-entries__choicetable_xbq_cvh_vdb}  
   After you have approved the EDL entry and it is activated, the Palo Alto Networks retrieves the EDL entry after the next retrieval interval. After the entry is retrieved, the observable is blocked from that point forward. In the following figure, note that the Active check box is selected, the status is Added, and the work notes indicate that the request has been approved.
{#tisc-approve-edl-entries__steps_sn5_mby_cdc}

*[\>]: and then