Splunk Enterprise Security

Unable to upload Threat Intelligence to ES despite Valid Directory

dkolekar_splunk
Splunk Employee
Splunk Employee

I have been trying to upload intelligence to Splunk ES. But getting following error continuously.
"The upload directory is not found or invalid."

What I have tried:
1. Copied the file directly to the folder "C:\Program Files\Splunk\etc\apps\DA-ESS-ThreatIntelligence\local\data\threat_intel"
2. Tried using the WebUI from multiple locations with the same error.
3. Created a manual CSV with only the "IP" header and just ip addresses. The same error occurs.

Splunk Env:
Splunk ES Version: 5.2.2
Splunk Enterprise: 7.2.3

0 Karma
1 Solution

dkolekar_splunk
Splunk Employee
Splunk Employee

This issue is related to SOLNESS-17951.

The actual issue is not with the custom threat_intel files that you're attempting to upload. This bug only applies to Windows environments. Specifically, the method used to decode "C:\Program Files\", the split between 'Program and Files' isn't handled properly causing you to be presented with the error message to the UI. This issue has been fixed in the next release of Enterprise Security (5.3.0).
Link: https://docs.splunk.com/Documentation/ES/5.3.0/RN/FixedIssues

The workaround is to modify the .py script that handles this section of Threat Intelligence.

Steps:

1) stop splunkd
2) copy C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py to C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py.backup
3) edit C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py
4) navigate to line number 43
5) replace this line of code:
return os.path.join(drive, *[i for i in path_components if i != ''])
TO
return os.path.normpath(pathstr.strip())
6) save the changes
7) restart splunkd
8) Once restarted, try uploading the .csv file again.

View solution in original post

dkolekar_splunk
Splunk Employee
Splunk Employee

This issue is related to SOLNESS-17951.

The actual issue is not with the custom threat_intel files that you're attempting to upload. This bug only applies to Windows environments. Specifically, the method used to decode "C:\Program Files\", the split between 'Program and Files' isn't handled properly causing you to be presented with the error message to the UI. This issue has been fixed in the next release of Enterprise Security (5.3.0).
Link: https://docs.splunk.com/Documentation/ES/5.3.0/RN/FixedIssues

The workaround is to modify the .py script that handles this section of Threat Intelligence.

Steps:

1) stop splunkd
2) copy C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py to C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py.backup
3) edit C:\Program Files\Splunk\etc\apps\SA-Utils\lib\SolnCommon\pathutils.py
4) navigate to line number 43
5) replace this line of code:
return os.path.join(drive, *[i for i in path_components if i != ''])
TO
return os.path.normpath(pathstr.strip())
6) save the changes
7) restart splunkd
8) Once restarted, try uploading the .csv file again.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...