Advance your Palo Alto firewall with ShadowNet IP blocking technology

IP blocking can effectively secure your infrastructure and prevent data loss

Developed by RA Labs, ShadowNet is the aggregation and analysis of data from a wide range of intelligence sources, processed into a precise shunlist.
RiskAnalytics' ShadowNet feed is optimized specifically for ingestion by Palo Alto firewalls. We use the External Dynamic List feature that is available in PAN-OS 7.1 or higher.
When ShadowNet is added to your Palo Alto firewall, it becomes a powerful bi-directional blocking system.  External attacks from malicious IP address are dropped. Internal hosts that attempt to access malicious IP addresses that can lead to infection are blocked.
ShadowNet strengthens your firewall’s ability to deal with evasion attacks by dropping the external IP. Signatures are not used.

Intel Response Timeline

(click to see larger image)

How We Do It

(click to see larger image)


We continuously aggregate customers networks and compare it against our existing database


Approved intel is normalized to a common format for analysis:

  • M2M
  • STIX
  • YETI


The resulting intel is automated for mechanized response, or forwarded to RA Labs for further research, analysis or reference


The resulting threat intelligence is ShadowNet

You work hard to grow your company. We work hard to defend it. 

Click on the image to download ShadowNet documents.

Contact RA Sales & Support

Business hours: Monday - Friday, 8am - 5pm


Email /
Phone / 1.855.639.4427


Email /
Phone / 1.855.639.4427

Fields marked with * are required