Systems and methods for firewall configuration using block lists

A computer-implemented method, comprising:

• adding an entry as a record in a block list entries table and associating the entry with a block list in a block list table and with an observable in an observables table;
• activating the entry in the block list entries table to allow or block subsequent occurrences of the observable on a client network by:
• modifying a value of an “active” field of the entry to true;
• modifying a value of a “status” field of the entry to “added”;
• modifying a value of a “date added” field of the entry to a current date;
• and
• storing a date in an “expired date” field of the entry that is calculated based on the current date and an “expiration period” field storing an integer value;
• and
• receiving a request for the block list from a firewall disposed on the client network and, in response, generating the block list from activated entries in the block list table and block list entries table and sending the block list to the firewall, wherein the firewall is configured to allow or block network traffic associated with the observable on the client network in accordance with the block list.

A non-transitory, computer-readable medium storing instructions executable by a processor of a computing system to host a Representational State Transfer (REST) server and a database, wherein the instructions comprise:

• instructions to create an entry in a block list entries table of the database and associate the entry with an observable stored in an observables table of the database, in response to input received from a first authorized security role;
• instructions to activate the entry in the block list table, in response to input received from a second authorized security role, wherein the instructions to activate the entry comprise instructions to:
• modify a value of an “active” field of the entry to true;
• modify a value of a “status” field of the entry to “added”;
• modify a value of a “date added” field of the entry to a current date;
• and
• store a date in an “expired date” field of the entry that is calculated based on the current date and an “expiration period” field storing an integer value;
• and
• instructions to generate a block list from activated entries in the block list table, in response to a REST request from a firewall disposed on the client network, and send the block list to the firewall as a REST response, wherein the firewall is configured to allow or block network traffic associated with the observable on a client network in accordance with the block list.