R81.10: External IOC processing failed

[wladw]

Hi all,

We tried to add an external IOC but we faced this issue:

Our feed config:

Even with .csv from  IOC Example (sk132193) (checkpoint.com) we're having the same issue 

What could be the problem?

Here's our .csv:

[Pauli]

Hi,

what is the delimiter? You have set it to "," - but in the csv the delimiter is "blank" or "tab". So change the config 🙂

[the_rock]

Agree, as soon as I opened it, I could tell values were not correct. Anyway, not a big deal, I corrected it and tested in the lab, works fine.

Lets see if @wladw can confirm.

Best,

Andy

[the_rock]

Let me test it in my lab and see whats going on, will report back.

Best,

Andy

[the_rock]

@wladw 

I fixed it for you, attached

below is example:

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_ThreatPrevention_AdminGuide/...

Andy

[wladw]

Thank you, but even with this .csv the same problem appears

Also, for some reason it's in the AV blade

[the_rock]

Can you send screenshots how you did it? Thats easy to fix, just replace AV with AB in the csv file.

Andy

[wladw]

And yeah, we added the external csv via the SmartConsole (not through the cli as in the examples). Could this be a problem?