Splunk Enterprise Security

Threat list download failed - palevo_ip_blocklist download failed after multiple retries

season88481
Contributor

Hi

My ES threat list download is thru proxy server. Other threat list are being download normally. Only the palevo_ip_blocklist failed a while ago.

Error message:
INFO msg="A threat intelligence download has failed" stanza="palevo_ip_blocklist" status="threat list download failed after multiple retries" uri="https://palevotracker.abuse.ch/blocklists.php?download=ipblocklist"

I try the url in my own laptop, and I got a 403 permission denied message on the webpage.

Any idea why threatlist download failed for 1 source only?

Cheers,

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi season88481,

when accessing this base URL https://palevotracker.abuse.ch I get this message:

 # Palevo Tracker has been discontinued

Maybe you need to disable this threat list.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi season88481,

when accessing this base URL https://palevotracker.abuse.ch I get this message:

 # Palevo Tracker has been discontinued

Maybe you need to disable this threat list.

Hope this helps ...

cheers, MuS

asimagu
Builder

hey @Mus , funny story:
when we found out about this we disabled the palevo download and we stopped seeing the error message, but then we upgraded to ES 4.7.1 and got the message back even though we removed all trace of the palevo download...... dodgy dodgy dodgy.....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...