Knowledge Management

Splunk Enterprise security Custom Threat intel feed

umesh
Path Finder

Hi,

 

We have Configured custom threat intel feeds with splunk. The connection is succesful the status of the file shows "file downloaded". 

I have checked the threat intel audit logs and found some thing here | status="No observables or indicators found in file" stanza="custom feeds"

It is a CSV file and we have checked the ouput by giving the curl command and we got the response as IOC listed in the excel.

but we  found this issue  | status="No observables or indicators found in file" stanza="custom feeds"

Can you help me how to fix this issue . 

Labels (4)
Tags (2)
0 Karma

umesh
Path Finder

The custom threat intel integration is with IOC/stix/STIX2 and we are using Splunk Cloud.

0 Karma

mbozbura
Engager

I have the same issue i have a valid stix2, did you find a solution for this?

0 Karma

DanielPi
Moderator
Moderator

Hi @mbozbura,

I’m a Community Moderator in the Splunk Community.

This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you! 

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...