topic Re: Splunk Enterprise security Custom Threat intel feed in Knowledge Management

Splunk Enterprise security Custom Threat intel feed

umesh — Wed, 19 Apr 2023 08:54:18 GMT

Hi,

We have Configured custom threat intel feeds with splunk. The connection is succesful the status of the file shows "file downloaded".

I have checked the threat intel audit logs and found some thing here | status="No observables or indicators found in file" stanza="custom feeds"

It is a CSV file and we have checked the ouput by giving the curl command and we got the response as IOC listed in the excel.

but we found this issue | status="No observables or indicators found in file" stanza="custom feeds"

Can you help me how to fix this issue .

Re: Splunk Enterprise security Custom Threat intel feed

umesh — Wed, 19 Apr 2023 09:02:08 GMT

The custom threat intel integration is with IOC/stix/STIX2 and we are using Splunk Cloud.

Re: Splunk Enterprise security Custom Threat intel feed

mbozbura — Mon, 15 Apr 2024 13:43:44 GMT

I have the same issue i have a valid stix2, did you find a solution for this?

Re: Splunk Enterprise security Custom Threat intel feed

DanielPi — Mon, 15 Apr 2024 14:11:05 GMT

Hi @mbozbura,

I’m a Community Moderator in the Splunk Community.

This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you!