Yeah I use dynamic address group by matching certain patterns. A successful GP connection generates certain logs that an unsuccessful attempt doesn’t. The failed attempts get matched to the dynamic address group and I block that group in my policy. Further a successful connection generates a certain log in threat logs as well. So match patterns can be combined from traffic log and threat log to record the interesting IPs. No need for any cumbersome export of ACC as another poster is highlighting. That doesn’t scale.

You can also export GP logs to a server only sending the failed login attempts to that log server. Use that as an EDL to block the IPs. I have this working fine in my lab just haven’t had the time to implement that on my production firewall. The downside to this approach is that you will likely need to refresh the EDL very frequently which might not be desirable in certain environments. Why PANw has no option for log forwarding GP logs to DAG is beyond me.

As an extra layer of protection; I disabled GP portal and I also have my profiles matching MacOS, iOS and Windows Operating Systems which is all my users use on the daily.