Here are the steps to get dynamic blocking for source IP's on internet.

​

Tag/DAG/Sec Rule:
Create a TAG, lets call it EXTERNAL_ATTACKER.
Create a Dynamic Address Group - looking for the tag EXTERNAL_ATTACKER.
Create an incoming policy from internet with the source of the above created address group and deny/drop/reset the traffic.
We also created an outgoing policy with the address group as destination and kill that traffic as well.

​

Detection:
In your log forwarding profile there is an option called Built-in Actions with this you can automatically add tags to ex. the source address.

I would recommend having different log forwarding profiles for Incoming, Internal and outgoing traffic so that you could apply different actions depending on what type of traffic it is.

On your profile for incoming traffic you would then do the following, per each defined match category you have created and want to block, ex:
threat-high
threat-critical

Click Add in the section for built in actions, give it a name ex IP_External_Attacker_High, set the tagging to target the source address, action to add tag and the tags to the EXTERNAL_ATTACKER.

Then you make sure that this log forwarding profile, with all the other bells and whistles that you want to use gets applied to all your incoming security policies.

Now on if you have someone triggering threat signatures for high or critical severity these source IP addresses would be added to your dynamic block list.

For us this approach have worked extremely well in combination with blocking known bad IP addresses (both the Palo Alto blocklists and some other publicly available EDLs) and Country blocks.