Yep there are lots of ways to achieve that, I would probably start by looking at what format do your firewalls need that IP information in order to ingest it - do they need json or csv or something like that, or can you push the bad IP addresses and domains directly to the devices using an API?
If you just want your firewalls to pick up a csv or json file then you could use Logic Apps to run a KQL query that retrieves all the information from your incidents and then exports that list to a csv/json file somewhere (storage account, s3, whatever makes sense for you)
