IOC-BLOCK-LIST

TheOrchard receives email from Sony Global Security Incident Response Team (GSIRT) to make changes to the Domain and IP
address block lists to our NY and AVL palo alto firewalls.  Email contains two files (IOC_domains_block_additions.txt)
and (IOC_IP_Address_block_additions.txt). Upon receiving an email please append new domains and IPs to the these files
in this repo.

##### Example of the GSIRT blocks request from the email.
```
Email subject: (ISIR-6089) Request for Domain Name & IP Blocks on Orchard Platform
IOC_domains_block_additions.txt : 1.2.3.4
IOC_IP_Address_block_additions.txt: wxyz.com
```

##### Example of how to add domains and IPs to TheOrchard list
```
domain_blocks.txt: *.wxyz.com
url_block.txt: *.wxyz.com/* #This is same as the domain block but a different format.
ip_blocks.txt: 1.2.3.4/32
```

##### How to remove domains and IPs from TheOrchard list
Save the IOC_domains_block_removals.txt and/or IOC_IP_Address_block_removals.txt files to this directory.
Run dos2unix against the file(s). You need to install dos2unix if you don't have it. `brew install dos2unix`
Run either or both of the scripts to remove domains or IP addresses.
`./remove_domains.sh`
`./remove_ip_addresses.sh`


##### GIT commit message
Example of the git commit message when opening a PR. GIT message is used for auto responding to the email once ioc-block-list-pipeline has delployed to the fargate.
```
(ISIR-6089) Domains and IPs added to the block list at NY and AVL sites.
```


##### External Dynamic List Limitations
| Firewall model | URL LIST ENTRY LIMITS | DOMAIN LIST ENTRY LIMITS | IP LIST ENTRY LIMITS |
|----------------|-----------------------|--------------------------|----------------------|
| PA-3200 Series | 100,000               | 1,000,000                | 50,000               |