TAXII files being downloaded but not processed by Enterprise Security

torowa — Tue, 24 Aug 2021 05:04:22 GMT

Hi Splunkers.

We are having an issue whereby a TAXII feed has stopped being incorporated into the Enterprise Security Threat Intelligence module.

The feed has been working o.k. (i.e. downloading and importing indicators) for some time but in recent times only the download is working.

- Threat Intelligence Audit in ES the download shows no errors (exit_status of 0)
- We can see the downloaded .xml file with TAXII indicators in the SA-ThreatIntelligence/local/data/threat_intel directory.
- threatlist.log also shows a successful download

I don't see anything specific in the logs showing an issue processing the download files.

In Security Intelligence --> Threat Intelligence --> Threat Artifacts we see where earlier files.

Any other suggestions for where to look to diagnose/resolve this issue.

Cheers!

topic TAXII files being downloaded but not processed by Enterprise Security in Splunk Search

TAXII files being downloaded but not processed by Enterprise Security