Threat list download failed - palevo_ip_blocklist download failed after multiple retries

[season88481]

Hi

My ES threat list download is thru proxy server. Other threat list are being download normally. Only the palevo_ip_blocklist failed a while ago.

Error message:
INFO msg="A threat intelligence download has failed" stanza="palevo_ip_blocklist" status="threat list download failed after multiple retries" uri="https://palevotracker.abuse.ch/blocklists.php?download=ipblocklist"

I try the url in my own laptop, and I got a 403 permission denied message on the webpage.

Any idea why threatlist download failed for 1 source only?

Cheers,

[MuS · Accepted solution]

Hi season88481,

when accessing this base URL https://palevotracker.abuse.ch I get this message:

 # Palevo Tracker has been discontinued

Maybe you need to disable this threat list.

Hope this helps ...

cheers, MuS

[asimagu]

hey @Mus , funny story:
when we found out about this we disabled the palevo download and we stopped seeing the error message, but then we upgraded to ES 4.7.1 and got the message back even though we removed all trace of the palevo download...... dodgy dodgy dodgy.....