Unable to upload Threat Intelligence to ES despite Valid Directory

[dkolekar_splunk]

I have been trying to upload intelligence to Splunk ES. But getting following error continuously.
"The upload directory is not found or invalid."

What I have tried:
1. Copied the file directly to the folder "C:\Program Files\Splunk\etc\apps\DA-ESS-ThreatIntelligence\local\data\threat_intel"
2. Tried using the WebUI from multiple locations with the same error.
3. Created a manual CSV with only the "IP" header and just ip addresses. The same error occurs.

Splunk Env:
Splunk ES Version: 5.2.2
Splunk Enterprise: 7.2.3

[dkolekar_splunk · Accepted solution]

This issue is related to SOLNESS-17951.

The actual issue is not with the custom threat_intel files that you're attempting to upload. This bug only applies to Windows environments. Specifically, the method used to decode "C:\Program Files\", the split between 'Program and Files' isn't handled properly causing you to be presented with the error message to the UI. This issue has been fixed in the next release of Enterprise Security (5.3.0).
Link: https://docs.splunk.com/Documentation/ES/5.3.0/RN/FixedIssues

The workaround is to modify the .py script that handles this section of Threat Intelligence.

Steps:

1) stop splunkd
2) copy C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py to C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py.backup
3) edit C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py
4) navigate to line number 43
5) replace this line of code:
return os.path.join(drive, *[i for i in path_components if i != ''])
TO
return os.path.normpath(pathstr.strip())
6) save the changes
7) restart splunkd
8) Once restarted, try uploading the .csv file again.