topic Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completely... in Firewall and Security Management

Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completely...

Bradley_Fillo — Tue, 26 Mar 2019 16:16:31 GMT

Hi everyone,

I have a partner who is working with external IOC feeds on a 5x00 device.

He is using the test feeds in SK132193 and they exhibit the behaviour shown in the screenshots I have attached. That is, at first they load successfully, then after about 30 minutes they report a partial failure, and then a complete failure to load.

He has verified there are no further external devices inhibiting communications, that he has installed the HFs according to the SK, and so on.

Thank you for any help. I have searched all of Support Centre, read all of the SKs I could find, and also run it past additional Check Point engineers to no avail.

Best regards,

-Brad

Re: Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completel

PhoneBoy — Tue, 26 Mar 2019 17:37:02 GMT

Perhaps as a separate thing I would manually fetch the feed using curl or similar periodically with a unique output file name.
This would allow you to see if there is a delta between the files you receive initially and subsequent ones.
If it's the same output that "worked initially" then started failing, that's obviously bad.
If there's something different in the file, then we need to see what's different and how that might be impacting import.
In any case, I highly recommend engaging the TAC with this.

Re: Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completel

Bradley_Fillo — Thu, 28 Mar 2019 22:18:44 GMT

Thanks Phoneboy! I have a TAC ticket opened.

I appreciate your help (as always)!

Re: Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completel

Vladimir — Thu, 28 Mar 2019 23:31:57 GMT

@Bradley_Fillo , please post your findings here, when you'll get to the bottom of this issue. I'd like to try using external IoCs myself and will be keeping an eye on this thread.

Thank you,

Vladimir