Splunk Enterprise Security

Unable to upload Threat Intelligence to ES despite Valid Directory

dkolekar_splunk
Splunk Employee
Splunk Employee

I have been trying to upload intelligence to Splunk ES. But getting following error continuously.
"The upload directory is not found or invalid."

What I have tried:
1. Copied the file directly to the folder "C:\Program Files\Splunk\etc\apps\DA-ESS-ThreatIntelligence\local\data\threat_intel"
2. Tried using the WebUI from multiple locations with the same error.
3. Created a manual CSV with only the "IP" header and just ip addresses. The same error occurs.

Splunk Env:
Splunk ES Version: 5.2.2
Splunk Enterprise: 7.2.3

0 Karma
1 Solution

dkolekar_splunk
Splunk Employee
Splunk Employee

This issue is related to SOLNESS-17951.

The actual issue is not with the custom threat_intel files that you're attempting to upload. This bug only applies to Windows environments. Specifically, the method used to decode "C:\Program Files\", the split between 'Program and Files' isn't handled properly causing you to be presented with the error message to the UI. This issue has been fixed in the next release of Enterprise Security (5.3.0).
Link: https://docs.splunk.com/Documentation/ES/5.3.0/RN/FixedIssues

The workaround is to modify the .py script that handles this section of Threat Intelligence.

Steps:

1) stop splunkd
2) copy C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py to C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py.backup
3) edit C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py
4) navigate to line number 43
5) replace this line of code:
return os.path.join(drive, *[i for i in path_components if i != ''])
TO
return os.path.normpath(pathstr.strip())
6) save the changes
7) restart splunkd
8) Once restarted, try uploading the .csv file again.

View solution in original post

dkolekar_splunk
Splunk Employee
Splunk Employee

This issue is related to SOLNESS-17951.

The actual issue is not with the custom threat_intel files that you're attempting to upload. This bug only applies to Windows environments. Specifically, the method used to decode "C:\Program Files\", the split between 'Program and Files' isn't handled properly causing you to be presented with the error message to the UI. This issue has been fixed in the next release of Enterprise Security (5.3.0).
Link: https://docs.splunk.com/Documentation/ES/5.3.0/RN/FixedIssues

The workaround is to modify the .py script that handles this section of Threat Intelligence.

Steps:

1) stop splunkd
2) copy C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py to C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py.backup
3) edit C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py
4) navigate to line number 43
5) replace this line of code:
return os.path.join(drive, *[i for i in path_components if i != ''])
TO
return os.path.normpath(pathstr.strip())
6) save the changes
7) restart splunkd
8) Once restarted, try uploading the .csv file again.

Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...