Merge pull request #360 from achrinzafork/new/palo-alto-cortex-cloud

new: [palo-alto-networks-cortex-cloud] create list

Author: adulau

README.md

@@ -87,6 +87,7 @@ There is also a standalone software project called [misp-feedback](https://githu
 - [microsoft-azure-germany/list.json](./lists/microsoft-azure-germany/list.json) - **List of known Microsoft Azure Germany Datacenter IP Ranges** - _Microsoft Azure Germany Datacenter IP Ranges_
 - [microsoft-azure-us-gov/list.json](./lists/microsoft-azure-us-gov/list.json) - **List of known Microsoft Azure US Government Cloud Datacenter IP Ranges** - _Microsoft Azure US Government Cloud Datacenter IP Ranges_
 - [microsoft-azure/list.json](./lists/microsoft-azure/list.json) - **List of known Microsoft Azure Datacenter IP Ranges** - _Microsoft Azure Datacenter IP Ranges_
+- [microsoft-mdca-proxy/list.json](./lists/microsoft-mdca-proxy/list.json) - **List of known Microsoft Defender for Cloud Apps (MDCA/MCAS) proxy hostnames** - _Microsoft Defender for Cloud Apps (MDCA/MCAS) hostnames (https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-url)_
 - [microsoft-office365-cn/list.json](./lists/microsoft-office365-cn/list.json) - **List of known Office 365 IP address ranges in China** - _Office 365 IP address ranges in China_
 - [microsoft-office365-ip/list.json](./lists/microsoft-office365-ip/list.json) - **List of known Office 365 IP address ranges** - _Office 365 IP address ranges_
 - [microsoft-office365/list.json](./lists/microsoft-office365/list.json) - **List of known Office 365 URLs** - _Office 365 URLs and IP address ranges_
@@ -105,7 +106,8 @@ There is also a standalone software project called [misp-feedback](https://githu
 - [onyphe-scanner/list.json](./lists/onyphe-scanner/list.json) - **List of published IP address ranges for Onyphe Scanner** - _Onyphe Scanner (https://www.onyphe.io/)_
 - [openai-gptbot/list.json](./lists/openai-gptbot/list.json) - **List of known IP address ranges for OpenAI GPT crawler bot** - _OpenAI gptbot crawler (https://openai.com/gptbot-ranges.txt)_
 - [oracle-oci/list.json](./lists/oracle-oci/list.json) - **List of known Oracle Cloud Infrastructure (OCI) IP address ranges** - _Oracle Cloud Infrastructure (OCI) IP address ranges (https://docs.oracle.com/en-us/iaas/Content/General/Concepts/addressranges.htm)_
-- [ovh-cluster/list.json](./lists/ovh-cluster/list.json) - **List of known Ovh Cluster IP** - _OVH Cluster IP address (https://docs.ovh.com/fr/hosting/liste-des-adresses-ip-des-clusters-et-hebergements-web/)_
+- [ovh-cluster/list.json](./lists/ovh-cluster/list.json) - **List of known OVH Cluster IPs** - _OVH Cluster IP address (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)_
+- [palo-alto-networks-cortex-cloud/list.json](./lists/palo-alto-networks-cortex-cloud/list.json) - **List of known Palo Alto Cortex Cloud IP ranges** - _Palo Alto Cortex Cloud IP address ranges (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)_
 - [palo-alto-networks-cortex-xpanse/list.json](./lists/palo-alto-networks-cortex-xpanse/list.json) - **List of known IP address ranges for Palo Alto Networks Cortex Xpanse** - _Palo Alto Networks Cortex Xpanse (https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity)_
 - [parking-domain-ns/list.json](./lists/parking-domain-ns/list.json) - **Parking domains name server** - _List of parking domain's name server_
 - [parking-domain/list.json](./lists/parking-domain/list.json) - **Parking domains** - _List of parking domain's ip adresses_
@@ -152,7 +154,7 @@ There is also a standalone software project called [misp-feedback](https://githu
 - [vpn-ipv4/list.json](./lists/vpn-ipv4/list.json) - **Specialized list of vpn-ipv4 addresses belonging to common VPN providers and datacenters** - _Specialized list of vpn-ipv4 addresses belonging to common VPN providers and datacenters_
 - [vpn-ipv6/list.json](./lists/vpn-ipv6/list.json) - **Specialized list of IPv6 addresses belonging to common VPN providers and datacenters** - _Specialized list of IPv6 addresses belonging to common VPN providers and datacenters_
 - [whats-my-ip/list.json](./lists/whats-my-ip/list.json) - **List of known domains to know external IP** - _Event contains one or more entries of known 'what's my ip' domains_
-- [wikimedia/list.json](./lists/wikimedia/list.json) - **List of known Wikimedia address ranges** - _Wikimedia address ranges (http://noc.wikimedia.org/conf/reverse-proxy.php.txt)_
+- [wikimedia/list.json](./lists/wikimedia/list.json) - **List of known Wikimedia address ranges** - _Wikimedia address ranges (https://wikitech.wikimedia.org/w/api.php?action=parse&page=IP_and_AS_allocations&format=json&prop=wikitext)_
 - [windows-binary-hashes/list.json](./lists/windows-binary-hashes/list.json) - **List of known hashes for Windows binaries** - _List of known Windows binaries based on hashes from winbindex (https://github.com/m417z/winbindex)_
 - [zscaler/list.json](./lists/zscaler/list.json) - **List of known Zscaler IP address ranges** - _Zscaler IP address ranges (https://config.zscaler.com/api/zscaler.net/hubs/cidr/json/recommended)_
 

generate_all.sh

@@ -48,8 +48,9 @@ python3 generate-internetcleanup-scanner.py
 #python3 generate-umich-cse-connection-attempts.py # ON HOLD DUE TO 403 (due to User-Agent)
 python3 generate-icloud-private-relay.py
 python3 generate-bunny-net.py
-python generate-ovh.py
+python3 generate-ovh.py
 python3 generate-microsoft-mdca.py
+python3 generate-palo-alto-networks-cortex-cloud.py
 popd
 
 ./jq_all_the_things.sh

lists/palo-alto-networks-cortex-cloud/list.json

@@ -0,0 +1,291 @@
+{
+  "description": "Palo Alto Cortex Cloud IP address ranges (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)",
+  "list": [
+    "104.155.131.72",
+    "104.199.223.229",
+    "136.110.132.208",
+    "136.110.146.246",
+    "159.183.150.248",
+    "34.101.101.170",
+    "34.101.125.66",
+    "34.101.155.198",
+    "34.101.158.32",
+    "34.101.214.157",
+    "34.101.218.184",
+    "34.101.79.159",
+    "34.102.139.110",
+    "34.102.140.103",
+    "34.102.237.151",
+    "34.105.137.22",
+    "34.105.173.229",
+    "34.105.227.146",
+    "34.107.129.254",
+    "34.107.161.143",
+    "34.107.213.85",
+    "34.107.3.224",
+    "34.107.57.23",
+    "34.107.61.141",
+    "34.107.83.197",
+    "34.111.129.144",
+    "34.111.134.57",
+    "34.111.188.248",
+    "34.111.58.152",
+    "34.111.6.153",
+    "34.116.176.97",
+    "34.116.202.235",
+    "34.116.213.71",
+    "34.116.216.55",
+    "34.116.223.119",
+    "34.116.67.90",
+    "34.117.211.129",
+    "34.117.240.208",
+    "34.118.124.130",
+    "34.118.48.171",
+    "34.118.62.80",
+    "34.118.71.237",
+    "34.118.92.214",
+    "34.120.102.147",
+    "34.120.119.85",
+    "34.120.142.18",
+    "34.120.213.187",
+    "34.120.213.188",
+    "34.120.229.65",
+    "34.120.31.199",
+    "34.120.87.77",
+    "34.126.183.208",
+    "34.126.212.40",
+    "34.128.115.238",
+    "34.128.126.138",
+    "34.128.156.84",
+    "34.128.157.130",
+    "34.128.82.158",
+    "34.131.101.138",
+    "34.131.111.87",
+    "34.131.116.135",
+    "34.131.131.141",
+    "34.131.165.103",
+    "34.131.207.151",
+    "34.131.47.126",
+    "34.132.108.184",
+    "34.142.3.42",
+    "34.142.44.136",
+    "34.146.181.233",
+    "34.146.60.215",
+    "34.147.107.51",
+    "34.147.67.188",
+    "34.149.165.12",
+    "34.149.180.250",
+    "34.149.248.76",
+    "34.151.236.197",
+    "34.151.83.236",
+    "34.154.154.5",
+    "34.154.168.139",
+    "34.154.173.134",
+    "34.154.186.12",
+    "34.154.195.120",
+    "34.154.208.247",
+    "34.154.229.60",
+    "34.154.23.156",
+    "34.154.230.76",
+    "34.154.243.11",
+    "34.155.110.169",
+    "34.155.197.131",
+    "34.155.222.152",
+    "34.155.41.247",
+    "34.155.5.100",
+    "34.155.5.117",
+    "34.155.90.61",
+    "34.159.53.97",
+    "34.160.28.41",
+    "34.163.125.167",
+    "34.163.155.105",
+    "34.163.57.57",
+    "34.165.120.206",
+    "34.165.131.171",
+    "34.165.156.139",
+    "34.165.17.246",
+    "34.165.2.110",
+    "34.165.24.222",
+    "34.165.27.131",
+    "34.165.33.165",
+    "34.165.43.106",
+    "34.165.46.47",
+    "34.166.53.160",
+    "34.166.53.242",
+    "34.166.54.238",
+    "34.166.54.6",
+    "34.166.55.153",
+    "34.166.58.213",
+    "34.166.58.243",
+    "34.166.58.79",
+    "34.166.59.20",
+    "34.166.61.81",
+    "34.175.18.78",
+    "34.175.182.55",
+    "34.175.198.50",
+    "34.175.205.166",
+    "34.175.230.35",
+    "34.175.255.99",
+    "34.175.27.251",
+    "34.175.30.176",
+    "34.175.46.46",
+    "34.175.80.182",
+    "34.18.30.132",
+    "34.18.32.96",
+    "34.18.34.118",
+    "34.18.34.73",
+    "34.18.37.73",
+    "34.18.39.0",
+    "34.18.39.155",
+    "34.18.44.71",
+    "34.18.46.240",
+    "34.18.53.229",
+    "34.22.66.91",
+    "34.35.13.198",
+    "34.35.42.196",
+    "34.35.45.251",
+    "34.35.56.170",
+    "34.35.60.86",
+    "34.35.64.191",
+    "34.35.69.156",
+    "34.35.70.193",
+    "34.35.79.219",
+    "34.35.80.189",
+    "34.36.155.211",
+    "34.39.136.78",
+    "34.39.140.36",
+    "34.39.161.254",
+    "34.39.177.125",
+    "34.39.195.104",
+    "34.54.155.245",
+    "34.54.5.247",
+    "34.64.107.163",
+    "34.64.189.205",
+    "34.64.228.117",
+    "34.64.237.45",
+    "34.64.45.118",
+    "34.64.46.249",
+    "34.64.54.175",
+    "34.64.84.25",
+    "34.64.93.168",
+    "34.65.108.153",
+    "34.65.137.215",
+    "34.65.155.169",
+    "34.65.213.226",
+    "34.65.222.25",
+    "34.65.225.124",
+    "34.65.233.60",
+    "34.65.248.119",
+    "34.65.51.103",
+    "34.65.89.6",
+    "34.66.69.154",
+    "34.69.63.16",
+    "34.69.88.119",
+    "34.8.224.70",
+    "34.8.234.58",
+    "34.8.67.192",
+    "34.80.133.68",
+    "34.80.230.166",
+    "34.80.34.30",
+    "34.81.38.132",
+    "34.84.125.129",
+    "34.84.201.32",
+    "34.84.225.105",
+    "34.84.93.160",
+    "34.84.99.239",
+    "34.85.68.167",
+    "34.87.167.125",
+    "34.87.61.186",
+    "34.87.83.144",
+    "34.89.183.45",
+    "34.89.197.46",
+    "34.89.42.214",
+    "34.89.56.78",
+    "34.90.16.31",
+    "34.90.67.58",
+    "34.90.70.107",
+    "34.90.71.103",
+    "34.91.128.226",
+    "34.91.26.125",
+    "34.93.118.113",
+    "34.93.175.218",
+    "34.93.3.196",
+    "34.93.9.198",
+    "34.95.33.72",
+    "34.95.62.136",
+    "34.95.66.187",
+    "34.95.8.232",
+    "34.96.120.25",
+    "34.96.83.202",
+    "34.98.68.183",
+    "34.98.77.231",
+    "35.186.207.80",
+    "35.189.176.163",
+    "35.189.18.208",
+    "35.190.0.180",
+    "35.190.13.237",
+    "35.190.79.68",
+    "35.190.88.43",
+    "35.197.175.44",
+    "35.197.181.108",
+    "35.197.219.110",
+    "35.198.112.13",
+    "35.198.38.182",
+    "35.199.96.109",
+    "35.200.146.253",
+    "35.200.158.164",
+    "35.200.175.78",
+    "35.200.234.99",
+    "35.200.3.131",
+    "35.201.142.86",
+    "35.201.22.63",
+    "35.201.23.188",
+    "35.202.21.123",
+    "35.203.101.162",
+    "35.203.108.13",
+    "35.203.35.23",
+    "35.203.57.162",
+    "35.203.82.121",
+    "35.203.90.79",
+    "35.203.99.74",
+    "35.204.129.196",
+    "35.222.81.194",
+    "35.223.6.69",
+    "35.224.140.142",
+    "35.225.156.101",
+    "35.227.237.180",
+    "35.229.186.216",
+    "35.234.118.195",
+    "35.234.18.10",
+    "35.234.8.249",
+    "35.240.144.192",
+    "35.240.243.57",
+    "35.240.255.15",
+    "35.241.28.254",
+    "35.242.159.176",
+    "35.242.180.163",
+    "35.242.201.199",
+    "35.244.133.254",
+    "35.244.157.127",
+    "35.244.250.18",
+    "35.244.251.25",
+    "35.244.5.205",
+    "35.244.57.196",
+    "35.244.66.177",
+    "35.244.73.76",
+    "35.244.93.0",
+    "35.247.148.38",
+    "35.247.161.94",
+    "35.247.173.40"
+  ],
+  "matching_attributes": [
+    "ip-src",
+    "ip-dst",
+    "domain|ip",
+    "ip-src|port",
+    "ip-dst|port"
+  ],
+  "name": "List of known Palo Alto Cortex Cloud IP ranges",
+  "type": "cidr",
+  "version": 20260819
+}

tools/generate-palo-alto-networks-cortex-cloud.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import re
+from generator import download_to_file, get_version, write_to_file, get_abspath_source_file
+
+# Rough IPv4 and IPv6 extraction regex taken from `generate-ovh.py`
+ip_regex = re.compile(r'[" ](\d{1,3}(?:\.\d{1,3}){3})[\\:]')
+
+def process(file, dst):
+    warninglist = {
+        'name': "List of known Palo Alto Cortex Cloud IP ranges",
+        'version': get_version(),
+        'description': "Palo Alto Cortex Cloud IP address ranges (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)",
+        'type': "cidr",
+        'list': [],
+        'matching_attributes': [
+            "ip-src",
+            "ip-dst",
+            "domain|ip",
+            "ip-src|port",
+            "ip-dst|port"
+        ]
+    }
+
+    with open(get_abspath_source_file(file), 'r') as f:
+        file_contents = f.read()
+        warninglist['list'].extend(list(map(lambda x: ''.join(x), ip_regex.findall(file_contents))))
+
+    write_to_file(warninglist, dst)
+
+
+if __name__ == '__main__':
+    source = "https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources"
+    file = "palo-alto-networks-cortex-cloud.html"
+    download_to_file(source, file)
+    process(file, "palo-alto-networks-cortex-cloud")