ES: Understanding the "Unable to Parse Modified Timestamp" Warning in STIX Threat Intelligence Feed Processing

Applicability

Description

During the processing of STIX Threat Intelligence feeds, a warning message stating "unable to parse modified timestamp " may appear. It is important to note that this is merely a warning message and does not impact the actual processing of the threat intelligence file.

Investigation

Upon investigation, it was found that the issue arises because the <stix:STIX_Package ...> node in the response lacks a timestamp attribute. This missing attribute triggers the warning, though it does not interfere with the processing of the feed.

Resolution

To resolve this issue, collaborate with the team responsible for providing the threat intelligence file. Ensure that the timestamp field is included in the <stix:STIX_Package ...> node. The corrected format should look like this:

<stix:STIX_Package ... timestamp="2021-04-12T12:40:32.808436">

By adding the timestamp attribute, the warning should be eliminated, and the feed will process without any related issues.