topic Re: Importing Indicator Error "Indicator in row 1 has less fields than expected" in Firewall and Security Management

Importing Indicator Error "Indicator in row 1 has less fields than expected"

pfilipe — Thu, 03 Mar 2022 09:52:31 GMT

Hello,

I am trying to Import a External CSV File to Checkpoint Indicators but getting the error "Indicator in row 1 has less fields than expected".

Already tried with Checkpoint examples as seen on https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132193. But no success.

Could somone provide me an CSV that works to see what is the correct syntax and to see if i keep getting the error?

Best regards.

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

the_rock — Thu, 03 Mar 2022 14:56:17 GMT

You may want to have TAC help you with this, as I saw someone post same problem before on here, but there was no solution. Personally, I had never tried this before, so wont even try give you a suggestion, sorry.

Though, if you can provide me with your CSV file and steps you used to import it, Im happy to try it in my lab and report back.

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

pfilipe — Thu, 03 Mar 2022 14:56:57 GMT

Will Open a TAC case then. If i get any developments will post here.

Thanks anyway!

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

G_W_Albrecht — Thu, 03 Mar 2022 15:00:10 GMT

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/Topics-TPG/Supported-Indicator-Files.htm?tocpath=Configuring%20Advanced%20Threat%20Prevention%20Settings%7CConfiguring%20Threat%20Indicators%7C_____1

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

AaronCP — Tue, 08 Mar 2022 17:25:24 GMT

Hey @pfilipe,

Have you had a response from TAC? I'm getting this error when importing an IOC CSV file into R80.40 SmartConsole. Interested to see if TAC have given you any advice/example CSVs.

Thanks,

Aaron.

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

pfilipe — Tue, 08 Mar 2022 17:32:59 GMT

Hello Aaron,

I found the correct Syntax it needs to have all the fields Uniq-Name,value,Type,Confidence,Severity,Product,Comment.

Where Value is the IP/URL/DOMAIN you want to block. Like this!

domain1,google.com,Domain,high,high,AV,Domain

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

AaronCP — Tue, 08 Mar 2022 17:40:04 GMT

That's great! Thanks for that 😊

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

kweiwing_neng — Thu, 01 Sep 2022 09:16:16 GMT

Hi @pfilipe,

Possible could share the csv example template? Many thanks.

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

pfilipe — Thu, 01 Sep 2022 09:32:35 GMT

Hello,

Yes, this is for hashes for example.
The syntax is Uniq-Name,value,Type,Confidence,Severity,Product,Comment.

Product are AV - Antivirus and AB-AntiBot.

The comment is not Mandatory and can be null. If you want to use an IP for example:

IP1,192.168.1.1,IP,high,high,AB,

Best regards,

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

kweiwing_neng — Thu, 01 Sep 2022 09:43:45 GMT

Hi Pfilipe,

Many thanks for the feedback, however was try import the file you gave thru smartconsole still encounter the same error.

Is that any syntax need to add in order to import?

Best Regards,

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

pfilipe — Thu, 01 Sep 2022 09:59:16 GMT

That is weird. Because i have the exact same file implemented on a checkpoint in R81.10. Only if checkpoint changed the syntax somehow...

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

AaronCP — Mon, 05 Sep 2022 19:19:24 GMT

I am using this exact template for our IOC feed on R81 management

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

kweiwing_neng — Tue, 06 Sep 2022 01:26:21 GMT

@AaronCP

Many thanks the file, is work perfectly.

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

Shiran_Gold — Thu, 08 Sep 2022 11:46:51 GMT

Hello,

I am happy to see the issue was resolved.

Loading IOC CSV is based on using Check Point's template.

more information can be found in sk132193

in R81.10 presents new IOC capabilities that allows IOC configuration using a simple menu which will include custom feeds as well

Re: Importing Indicator Error "Indicator in row 1 has less fields than expected"

Vimal_ananth — Mon, 02 Jun 2025 09:50:27 GMT

we got same error that u got we have smart console on remote server have can we resolve this issue