Splunk Enterprise security Custom Threat intel feed

[umesh]

Hi,

We have Configured custom threat intel feeds with splunk. The connection is succesful the status of the file shows "file downloaded". 

I have checked the threat intel audit logs and found some thing here | status="No observables or indicators found in file" stanza="custom feeds"

It is a CSV file and we have checked the ouput by giving the curl command and we got the response as IOC listed in the excel.

but we  found this issue  | status="No observables or indicators found in file" stanza="custom feeds"

Can you help me how to fix this issue . 

[umesh]

The custom threat intel integration is with IOC/stix/STIX2 and we are using Splunk Cloud.

[mbozbura]

I have the same issue i have a valid stix2, did you find a solution for this?

[DanielPi]

Hi @mbozbura,

I’m a Community Moderator in the Splunk Community.

This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you!