Splunk Enterprise Security

Spontaneous "Health Check" error messages reported on ES Search Head regardng "maxmind_geoip_asn_ipv6" failed download?

Esteemed Legend

We are getting the following errors on our Enterprise Security Search Head and are wondering why and how to fix them:

Health Check: Intelligence download of "maxmind_geoip_asn_ipv6" has failed on host "ES_Search_Head_Host" at: Sat Apr 27 20:45:45 2019 "threat list download failed after multiple retries"  Learn more.
4/27/2019, 9:00:31 PM
Health Check: Intelligence download of "maxmind_geoip_asn_ipv4" has failed on host "ES_Search_Head_Host" at: Sat Apr 27 20:45:45 2019 "threat list download failed after multiple retries"  Learn more.
4/27/2019, 9:00:31 PM

If I have to, I will dig into it and figure it out and followup here, but I am hoping that somebody has already figured it out.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Just installed ES 5.3.0 and the old URL is still used, but it is disabled. Here is the new URL https://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN-CSV.zip to download the file.

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Just installed ES 5.3.0 and the old URL is still used, but it is disabled. Here is the new URL https://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN-CSV.zip to download the file.

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

The download works fine using http or https, to me it looks the post processing of the files fails in ES. For now I just use a work around and download the file by cronjob, put the csv into the lookup folder and use the lookup:// URL in ES.

cheers, MuS

0 Karma

Explorer

@MuS - whether it is downloading with the new link? I am still getting the same error

0 Karma

Esteemed Legend

Go to Enterprise Security -> Configure -> Data Enrichment -> Intelligence Downloads and search for maxmind. You will see 2 entries and these have the following URLs:

https://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum2.zip
https://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum2v6.zip

As expected, these URLs are no longer valid. I found this link with more details:
https://support.maxmind.com/geolite-legacy-discontinuation-notice/

I am on ES v5.1.0 which is not the latest and I assume that the later versions have already accommodated this discontinuation. For now, until I upgrade, I have just disabled these 2 feeds, since we are not using them anyway.

Esteemed Legend

@ppablo_splunk You should unaccept my answer and accept the one from @MuS.

Community Manager
Community Manager

Thanks @woodcock !