Threatlist scheme error - unable to initialize modular input

[acadea]

Hello,

There is an error "unable to initialize modular input "threatlist"" and it's blocking all the Threat Intel features

How can I troubleshoot and solve this ? Is this a python error ?

The effects are the stanzas are not loaded and the Threat Intelligence Management Menu ( Configure > Data Enrichment) is not loaded and it's showing "not found".

See error log below

Thanks for your ideas

[acadea]

ok, found it, I'll leave this here if anyone else will ever encounter this:

it's a bug in Splunk Enterprise Security 6.4.0 which is fixed in 6.41.

Check the release notes for 6.4.1

SOLNESS-24926

Threat Intelligence Framework: Setting SPLUNK_DB triggers this error: ValueError: Illegal escape from parent directory "/opt/splunk": /splunkdata/modinputs/threatlist

https://docs.splunk.com/Documentation/ES/6.4.1/RN/FixedIssues