Importing Indicator Error "Indicator in row 1 has less fields than expected"

[pfilipe]

Hello,

I am trying to Import a External CSV File to Checkpoint Indicators but getting the error "Indicator in row 1 has less fields than expected".

Already tried with Checkpoint examples as seen on https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut.... But no success.

Could somone provide me an CSV that works to see what is the correct syntax and to see if i keep getting the error?

Best regards.

[the_rock]

You may want to have TAC help you with this, as I saw someone post same problem before on here, but there was no solution. Personally, I had never tried this before, so wont even try give you a suggestion, sorry.

Though, if you can provide me with your CSV file and steps you used to import it, Im happy to try it in my lab and report back.

[pfilipe]

Will Open a TAC case then. If i get any developments will post here.

Thanks anyway!

[AaronCP]

Hey @pfilipe,

Have you had a response from TAC? I'm getting this error when importing an IOC CSV file into R80.40 SmartConsole. Interested to see if TAC have given you any advice/example CSVs.

Thanks,

Aaron.

[pfilipe]

Hello Aaron,

I found the correct Syntax it needs to have all the fields Uniq-Name,value,Type,Confidence,Severity,Product,Comment.

Where Value is the IP/URL/DOMAIN you want to block. Like this!

domain1,google.com,Domain,high,high,AV,Domain

[AaronCP]

That's great! Thanks for that 😊

[G_W_Albrecht]

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/...