Hi all
Well I guess a picture says more than a thousand words, so I will try to show you the problem.
As you Malc0de and Emerging Threats get populated. The others have an N/A.
If I look in the troubleshooting logs, I'll see this:
[] Script Started at: 11-24-2016 12:42:35 GMT
[] Script version: 3.00
URL: http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
Finished retrieving 818 IPs from SpamHaus.
Finished retrieving 23 IPs from Dshield.
Finished retrieving 716 IPs from Feodo.
URL: http://rules.emergingthreats.net/blockrules/compromised-ips.txt
Finished retrieving 1423 Emerging Threats Compromised IPs.
URL: http://www.binarydefense.com/banlist.txt
Finished retrieving 4336 IPs from Binary Defense.
URL: http://malc0de.com/bl/IP_Blacklist.txt
Finished retrieving 262 malc0de_IPs.
URL: https://reputation.alienvault.com/reputation.generic
Forbidden
Access denied!
[*] Executing get alerts script.
If I try to run the optiv_threat_lists.py manually, I'll get this:
/opt/splunk/etc/apps/optiv_threat_intel/bin# ./optiv_threat_lists.py
logfile_name: /opt/splunk/var/log/splunk/optiv_threat_lists_script11-24-2016-20-29-58.log
[*] Script Started at: 11-24-2016 20:29:58 GMT
[*] Script version: 3.00
URL: http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
Finished retrieving 818 IPs from SpamHaus.
Finished retrieving 23 IPs from Dshield.
Finished retrieving 716 IPs from Feodo.
URL: http://rules.emergingthreats.net/blockrules/compromised-ips.txt
Finished retrieving 1423 Emerging Threats Compromised IPs.
URL: http://www.binarydefense.com/banlist.txt
Finished retrieving 4370 IPs from Binary Defense.
URL: http://malc0de.com/bl/IP_Blacklist.txt
Finished retrieving 255 malc0de_IPs.
URL: https://reputation.alienvault.com/reputation.generic
Forbidden
Access denied!
Traceback (most recent call last):
File "./optiv_threat_lists.py", line 883, in
main()
File "./optiv_threat_lists.py", line 817, in main
parseAlienVault(raw_threatlist)
File "./optiv_threat_lists.py", line 703, in parseAlienVault
AlienVaultIPs = urlResults.split('# Generic format')
AttributeError: 'int' object has no attribute 'split'
Any help would be appreciated.
Thank you
... View more
