topic Re: R81.10: External IOC processing failed in Firewall and Security Management

R81.10: External IOC processing failed

wladw — Thu, 14 Mar 2024 09:32:49 GMT

Hi all,

We tried to add an external IOC but we faced this issue:

Our feed config:

Even with .csv from IOC Example (sk132193) (checkpoint.com) we're having the same issue

What could be the problem?

Here's our .csv:

Pauli — Thu, 14 Mar 2024 15:32:33 GMT

Hi,

what is the delimiter? You have set it to "," - but in the csv the delimiter is "blank" or "tab". So change the config 🙂

the_rock — Thu, 14 Mar 2024 16:23:30 GMT

Let me test it in my lab and see whats going on, will report back.

Best,

Andy

the_rock — Thu, 14 Mar 2024 16:39:29 GMT

I fixed it for you, attached

below is example:

Andy

the_rock — Thu, 14 Mar 2024 16:50:16 GMT

Agree, as soon as I opened it, I could tell values were not correct. Anyway, not a big deal, I corrected it and tested in the lab, works fine.

Lets see if @wladw can confirm.

Best,

Andy

wladw — Fri, 15 Mar 2024 05:48:35 GMT

And yeah, we added the external csv via the SmartConsole (not through the cli as in the examples). Could this be a problem?

wladw — Fri, 15 Mar 2024 05:51:15 GMT

Thank you, but even with this .csv the same problem appears

Also, for some reason it's in the AV blade

the_rock — Fri, 15 Mar 2024 11:41:48 GMT

Can you send screenshots how you did it? Thats easy to fix, just replace AV with AB in the csv file.

Andy