timestamp issues with threatconnect TA

jerm1020rq — Wed, 15 Dec 2021 20:46:28 GMT

Good Afternoon,

I am having an issue with the ThreatConnect TA. The API appears to be connecting as expected but no logs are in the index. I observed within splunkd.log the log sample found below. Looking at the props.conf, it appears it is configured correctly. has anyone had this issue? it appears the logs are in epoch time.

12-15-2021 20:36:44.013 +0000 WARN DateParserVerbose [38565 merging_1] - The TIME_FORMAT specified is matching timestamps (INVALID_TIME (1639600603907184)) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=tc_download_indicators.py|host=127.0.0.1|threatconnect-app-logs|10128188

PROPS.CONF config

[threatconnect-app-logs]
INDEXED_EXTRACTIONS = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timestamp
TIME_FORMAT = %s.%6N
category = Application
description = ThreatConnect App Logs
pulldown_type = 1

[threatconnect-event-data]
INDEXED_EXTRACTIONS = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timestamp
TIME_FORMAT = %s.%6N
category = Application
description = ThreatConnect Matched Event Data
pulldown_type = 1

[source::...tc_ar_send_to_playbook.log*]
sourcetype = send_event_to_threatconnect_playbook:*

topic timestamp issues with threatconnect TA in Getting Data In

timestamp issues with threatconnect TA