topic Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""? in Splunk Enterprise Security

Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

emmanuelpeter — Thu, 09 Mar 2017 14:41:47 GMT

Splunk Enterprise Security: why am I getting this error message?

msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites" status="threat list download failed after multiple retries"

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

mparks11 — Thu, 09 Mar 2017 17:28:14 GMT

Can you access the URL: https://s3.amazonaws.com/alexa-static/top-1m.csv.zip? This is where the Alexa Top Million is hosted. Personally, I can, so I know they haven't shut down the Alext top million (like happened a few months back and presumably will happen again). It's possible that your Splunk ES Search Head can't access that URL itself, blocked by a content filter or web proxy in your network somewhere. If you don't use the Alexa Top Million, you could just disable the input.

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

jwelch_splunk — Fri, 10 Mar 2017 05:07:41 GMT

You could also be hitting a bug.
What version of ES are you running?

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

emmanuelpeter — Fri, 10 Mar 2017 10:48:11 GMT

I'm currently running Splunk Version 6.4.1.2
what sort of bug could that be?

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

emmanuelpeter — Fri, 10 Mar 2017 10:53:18 GMT

I can access the CSV.Zip, but how can I check to see if my search head can access it. Thanks

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

jwelch_splunk — Fri, 10 Mar 2017 11:50:50 GMT

What version of ES are you running

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

emmanuelpeter — Fri, 10 Mar 2017 12:21:55 GMT

currently is 4.2.0

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

jwelch_splunk — Fri, 10 Mar 2017 13:46:43 GMT

Hmm, this indicates you are a cloud customer. If that is the case email me your info jwelch @ splunk dot com.

I will take a look for you.

Otherwise, if I am missing something here, we log the success or failure of a download in the threatlist.log in /opt/splunk/var/log/splunk

index=_internal source =*threatlist.log alexa

This could be related to a previous failure and now it is successful, and you are hitting the bug I was talking about, which I did not think affected 4.2.0

Or it really is failing and I need to see why from the backend.

If you are not a cloud customer you could try this from your SH

wget https://s3.amazonaws.com/alexa-static/top-1m.csv.zip? to determine if you have success.

Let me know here or via email how I can help

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

emmanuelpeter — Fri, 10 Mar 2017 15:03:39 GMT

I've dropped you an email. please do let me know if you receive it.

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

mparks11 — Fri, 10 Mar 2017 15:46:40 GMT

Looks like jwelch beat me to the punch!

wget https://s3.amazonaws.com/alexa-static/top-1m.csv.zip

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

jwelch_splunk — Fri, 10 Mar 2017 16:40:17 GMT

We ended up working this issue from a support perspective, and this was related to specific configs within the customers ENV. If customer wishes to share our findings he can note that here.

Having said that under normal circumstances, using wget to validate connectivity from SH to source is a good first start to understand why the download is failing.

Re: Splunk Enterprise Security: Why am I getting this error message "msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites""?

risgupta — Wed, 03 Jan 2018 07:50:20 GMT

https://answers.splunk.com/answers/606997/a-threat-intelligence-download-has-failedstatusthr-1.html?childToView=608146#answer-608146