Hi Splunkers.
We are having an issue whereby a TAXII feed has stopped being incorporated into the Enterprise Security Threat Intelligence module.
The feed has been working o.k. (i.e. downloading and importing indicators) for some time but in recent times only the download is working.
- Threat Intelligence Audit in ES the download shows no errors (exit_status of 0)
- We can see the downloaded .xml file with TAXII indicators in the SA-ThreatIntelligence/local/data/threat_intel directory.
- threatlist.log also shows a successful download
I don't see anything specific in the logs showing an issue processing the download files.
In Security Intelligence --> Threat Intelligence --> Threat Artifacts we see where earlier files.
Any other suggestions for where to look to diagnose/resolve this issue.
Cheers!
