Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1.

[vin02]

Hi,

We have upgraded Enterprise Security from 4.5.2. to 4.7.1. After the upgrade we are getting two types of error message in our environment.
Type 1:

msg="A script exited abnormally" input="/opt/splunk/etc/apps/SA-Utils/bin/configuration_check.py" stanza="configuration_check://confcheck_es_app_version" status="exited with code 3"

Type 2:

A threat intelligence download has failed. stanza="iblocklist_spyware" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_proxy" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_tor" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_piratebay" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_web_attacker" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_rapidshare" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_logmein" host="xxxxx" status="threat list download failed after multiple retries"

Could you please suggest on this?

[hcannon]

We had this same issue after upgrade to 4.7.0 - Splunk Support advised it was a bug in this version and provided the following fix, which worked for us -

Edit splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/configuration_checks/confcheck_failed_threat_download.py as below:

--- confcheck_failed_threat_download.old.py 
+++ confcheck_failed_threat_download.py 
@@ -33,7 +33,7 @@ 

messages = [] 

- job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest=earliest) 
+ job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest_time=earliest) 
while elapsed < srch_timeout: 
if job.isDone: 
if job.resultCount > 0 or job.eventCount > 0:

[mosman_splunk]

make sure that the directory still owned by the correct user

[vin02]

yes directory owned by correct user.

[gf13579]

I'm seeing 3 of the iblocklist* ones too, along with malware_domains. Our ES is running on Splunk Cloud