topic Getting error “Connect to 127.0.0.1:9999 failed. Connection refused“ when I start the Kaspersky Threat Feed App for Splunk in Security

Getting error “Connect to 127.0.0.1:9999 failed. Connection refused“ when I start the Kaspersky Threat Feed App for Splunk

xtlyk — Wed, 20 Jul 2016 09:27:43 GMT

Hi everyone,

i have installed the Kaspersky Threat Feed App for Splunk, but I'm getting error:

Connect to 127.0.0.1:9999 failed. Connection refused

in splunkd.log. I can't see any data in Splunk Web.
Can you help me? Thank you

Re: Getting error “Connect to 127.0.0.1:9999 failed. Connection refused“ when I start the Kaspersky Threat Feed App for Splunk

miteshvohra — Fri, 02 Sep 2016 07:58:24 GMT

The documentation of the App states : BEFORE YOU START USING THE APPLICATION, PLEASE CONTACT KASPERSKY LAB TO GET KASPERSKY THREAT FEED SERVICE AND ACCESS TO KASPERSKY THREAT INTELLIGENCE DATA FEEDS.

Kindly reach out to anyone in Kaspersky Lab team in your region for obtaining trial access to the feed service.

Kaspersky Threat Feed App for Splunk and Feed Service have the following system requirements.

Supported operating systems: Linux x64
Software requirements: Splunk 6.2+ & Python 2.6, 2.7

Source URL: https://help.kaspersky.com/KFS/1.0/en-EN/98426.htm

Make sure your system meets the stated requirements.

Please share your experience.

Mitesh.

Re: Getting error “Connect to 127.0.0.1:9999 failed. Connection refused“ when I start the Kaspersky Threat Feed App for Splunk

KasperskyLab — Mon, 19 Sep 2016 10:44:32 GMT

Hello, xtlyk!

Miteshvohra is right!
Please contact Kaspersky Lab to get Kaspersky Threat Feed Service (KTFS) and access to Threat Intelligence Data Feeds: https://www.kaspersky.com/enterprise-security/intelligence-services

The reason you got this error, because Kaspersky Threat Feed App for Splunk requires KTFS to be launched on you Linux system.

Please let us know if you have any question.
Thank you!

Re: Getting error “Connect to 127.0.0.1:9999 failed. Connection refused“ when I start the Kaspersky Threat Feed App for Splunk

miteshp250283 — Fri, 19 May 2017 12:57:18 GMT

@KasperskyLab: Any plans to release a working copy of app including the scripts and sample data?

We have prospect customers who are looking out for Kaspersky TDF and Splunk Enterprise Security integration.

Appreciate if you can upload the full version to Splunkbase.

Thanks, Mitesh.

Re: Getting error “Connect to 127.0.0.1:9999 failed. Connection refused“ when I start the Kaspersky Threat Feed App for Splunk

KasperskyLab — Tue, 23 May 2017 12:37:42 GMT

Hello Mitesh,

Please note that according to Splunkbase guideline, we can’t upload any binary (such as Kaspersky Threat Feed Service) other than App for Splunk. Thus, please contact our team responsible for security services – intelligence@kaspersky.com (please specify you are from Splunkbase). They will provide you with the full package to integrate Kaspersky Threat Data Feeds with Splunk.
Feel free to ask any question you have.

Thank you in advance.
Best regards, Kaspersky Lab.