Block Unauthorized AI Tools
Across Your Financial Network

# Palo Alto Networks CLI — Configure External Dynamic List for AI Tools

set external-list ai-tools-blocklist type domain
set external-list ai-tools-blocklist url "https://feeds.aitoolsblocklist.com/v1/edl/domains.txt"
set external-list ai-tools-blocklist refresh-rate "hourly"
set external-list ai-tools-blocklist certificate-profile "default"

# Create security policy rule
set rulebase security rules block-ai-tools from "trust"
set rulebase security rules block-ai-tools to "untrust"
set rulebase security rules block-ai-tools destination "ai-tools-blocklist"
set rulebase security rules block-ai-tools action "deny"
set rulebase security rules block-ai-tools log-end "yes"
set rulebase security rules block-ai-tools log-setting "soc-log-profile"

# Splunk SPL — Alert on AI tool access attempts by user

index=firewall sourcetype=pan:traffic action=denied
  dest_category="ai-tools-blocklist"
| lookup ad_users src_ip OUTPUT user, department, manager
| stats count by user, department, dest, _time
| where count > 5
| eval risk_score = case(
    department="Trading", 95,
    department="Wealth Management", 90,
    department="Compliance", 85,
    department="IT", 60,
    1=1, 70)
| sort - risk_score

# Python — Filter the AI Tools Blocklist by category for selective enforcement

import csv
import requests

# Categories to block in a financial institution
BLOCKED_CATEGORIES = {
    "Text & Language",         # Writing assistants, chatbots
    "Code & Development",       # Code assistants (IP risk)
    "Audio, Voice & Music",     # Voice cloning, transcription
    "Image & Visual",           # Deepfake risk
    "Agents & Automation",      # Autonomous data access
}

# Categories permitted for research analysts
ALLOWED_CATEGORIES = {
    "Data, Analytics & Research",
    "Search, Knowledge & Docs",
}

def generate_filtered_blocklist(csv_path, output_path):
    blocked_domains = []
    with open(csv_path) as f:
        reader = csv.DictReader(f)
        for row in reader:
            if row['primary_category'] in BLOCKED_CATEGORIES:
                blocked_domains.append(row['domain'])

    with open(output_path, 'w') as f:
        f.write('\n'.join(blocked_domains))

    print(f"Generated blocklist: {len(blocked_domains)} domains")

generate_filtered_blocklist(
    "ai_tools_database.csv",
    "financial_services_blocklist.txt"
)

# PowerShell — Generate quarterly AI tool compliance report

$startDate = (Get-Date).AddMonths(-3).ToString("yyyy-MM-dd")
$endDate = (Get-Date).ToString("yyyy-MM-dd")

# Pull blocked AI tool access attempts from SIEM API
$events = Invoke-RestMethod -Uri "https://siem.internal/api/search" `
  -Method POST -Body (@{
    query = "action=denied dest_category=ai-tools"
    earliest = $startDate
    latest = $endDate
  } | ConvertTo-Json)

# Summary statistics
$report = @{
    Period                    = "$startDate to $endDate"
    TotalBlockedAttempts      = $events.Count
    UniqueUsersBlocked        = ($events.user | Sort-Object -Unique).Count
    TopBlockedTools           = ($events | Group-Object dest |
                                Sort-Object Count -Descending |
                                Select-Object -First 10 Name, Count)
    BlocklistLastUpdated      = (Invoke-RestMethod "https://feeds.aitoolsblocklist.com/v1/meta").last_updated
    TotalDomainsInBlocklist   = (Invoke-RestMethod "https://feeds.aitoolsblocklist.com/v1/meta").total_domains
}

$report | ConvertTo-Json -Depth 3 |
  Out-File "Q$((Get-Date).Quarter)_AI_Tool_Compliance_Report.json"