Splunk Enterprise Security

Detected deprecated Threat Intelligence Manager inputs- Do I have to completely remove the inputs?

zekiramhi
Path Finder

Hello,

I am recieving the following warning on my alerts:

Health Check: Detected deprecated Threat Intelligence Manager inputs that are not supported by Enterprise Security version 6.4.0 or higher. Recreate these inputs as Threatlist inputs or remove if unnecessary.

Drill downing into the results of the deprecated inputs, I see the following:

zekiramhi_0-1618296721755.png

Which I have found them to be in the DA-ESS-ThreatIntelligence/local/inputs.conf file and disabled them via making the 0s to 1s in the "disabled" field section under each input.

Do I have to completely remove/comment the inputs out? Why else would I still keep recieving alerts about it when it is disabled? Is there any where else I should be looking or changing for the deprecated intelligence inputs?

Thanks,

Best Regards,

0 Karma
1 Solution

zekiramhi
Path Finder

Issue seems to have resolved itself after a server restart

View solution in original post

ssubhani
Explorer

I was facing similar Problem and I had to comment the inputs (even though they were disabled). After commenting the inputs and restarting the Splunk service, issue was resolved, and the warning disappeared.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

+1 to that. Disabling inputs wasn't sufficient because theye were still defined albeit disabled. Had to comment them out completely.

Maltov
New Member

Hello,

I am also receiving this type of error, but the inputs are necessary, so is there a way to resolve this without disabling them?

They are currently disabled in the same fashion listed above in @zekiramhi  post  ( 0  to 1 in the disabled fields) and still generating the error messages even after several server restarts.

Thanks in advance for any info.

//M

 

0 Karma

zekiramhi
Path Finder

Issue seems to have resolved itself after a server restart

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...