Splunk Enterprise Security

Detected deprecated Threat Intelligence Manager inputs

zekiramhi
Path Finder

Hello,

I am recieving the following warning on my alerts:

Health Check: Detected deprecated Threat Intelligence Manager inputs that are not supported by Enterprise Security version 6.4.0 or higher. Recreate these inputs as Threatlist inputs or remove if unnecessary.

Drill downing into the results of the deprecated inputs, I see the following:

zekiramhi_0-1618296721755.png

Which I have found them to be in the DA-ESS-ThreatIntelligence/local/inputs.conf file and disabled them via making the 0s to 1s in the "disabled" field section under each input.

Do I have to completely remove/comment the inputs out? Why else would I still keep recieving alerts about it when it is disabled? Is there any where else I should be looking or changing for the deprecated intelligence inputs?

Thanks,

Best Regards,

0 Karma
1 Solution

zekiramhi
Path Finder

Issue seems to have resolved itself after a server restart

View solution in original post

zekiramhi
Path Finder

Issue seems to have resolved itself after a server restart

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!