How to re-ingest TAXII2 Threat Intelligence Data in Splunk Enterprise Security

Applicability

Description

After deleting or recreating a TAXII2 feed in Splunk Enterprise Security, or after data retention has purged threat intelligence data, the *_intel lookup files (such as ip_intel and file_intel) may remain empty. Repeated polling cycles complete without ingesting any data, even after configuring the feed to retrieve historical records.

This issue affects environments running ES 8.2.x through 8.4.x and is caused by a known issue in how the Threat Intelligence Framework processes TAXII2 feed checkpoints and workload serialization.

Investigation

Follow the steps below to determine if this issue has been encountered.

Step 1 — Verify lookup file status

Run the following searches to confirm whether the *_intel lookup files are empty:

| inputlookup ip_intel | stats count
| inputlookup file_intel | stats count

A count of zero confirms that previously ingested threat intelligence data has been purged or was never re-ingested.

Step 2 — Review logs for error messages

Search threatlist.log for the affected stanza to identify polling failures:

index=_internal source="*threatlist.log" stanza="<STANZA_NAME>"

Look for the following repeated entries in the output:

status="No objects returned" envelope="{}" status="No STIX objects returned from TAXII2 feed" status="TAXII2 feed polling finished" bundle_count="0" total_bytes="0"

The presence of these messages on every poll cycle confirms that the feed is not ingesting any data.

Step 3 — Check the added_after parameter

In the same log output, locate the Start polling entry. Examine the added_after value. If added_after shows today's date rather than a date reflecting the configured historical earliest POST argument, the checkpoint has already advanced and the earliest argument will no longer be honored.

Root cause analysis :  Two underlying factors contribute to this behavior:

• ES 8.3/8.4 Workloads known issue: The Mission Control UI serializes the Workloads field as "[]" instead of empty, causing the addthreat workload to be skipped. Bundles are downloaded but never parsed, so *_intel KV stores remain empty.

• Checkpoint behavior: The earliest POST argument is only honored on the first poll of a new feed. After that, an internal checkpoint (last_run) takes over. If the first poll returns no data (empty envelope {}), the checkpoint still advances to current UTC, making historical re-ingestion via the earliest argument permanently impossible without recreating the stanza.

Resolution

Option 1: Upgrade to ES 8.5 or Later (Recommended) : 

1. Upgrade Splunk Enterprise Security to version 8.5 or later.
2. In Threat Intelligence Management, create a new TAXII2 feed with the required configuration.
3. Set the POST argument earliest="-1y" to request historical data.
4. Save the feed and allow the first poll to complete. The lookup files should be repopulated with historical data.
5. Validate lookup file with

    | inputlookup <lookup name>

Option 2: Temporary Workaround for ES versions prior to 8.5

If upgrading is not feasible, the feature-flag Workloads workaround must be applied before creating a new feed. Follow the steps below in order.

Part A :  Apply the feature-flag workaround:

1. Login to the ES stack.

2. Navigate to below URL in the browser 

   app/SplunkEnterpriseSecuritySuite/ess_configuration/#/intelligence/unified_sources

3. Open browser DevTools and select Application → Storage → Session Storage → https://<stack_name> on the left-side panel.

4. Select the key enterprise-security-feature-flags in the right-side panel.

5. Double-click on the value to edit the attributes.

6. Change the value of threatIntelligenceUnifiedSourcesUI to false.

7. Save it, reload the page, and validate that the changes are applied.

Part B :  Create a new feed and validate ingestion:

1. Navigate to Threat Intelligence Sources and create a new feed, filling in all the required details.

2. Provide POST argument earliest="-1y" to download historical data.

3. Save the feed and wait for the download to complete.

4. Validate the *_intel files.

Important Note : After applying this workaround, the feed must not be edited through the Mission Control UI. Because of this, Option 1 (upgrade) is the only durable solution.

Validation :

• Confirm that the lookup files contain the expected number of records after following the solution steps.

• If lookup files are still missing data, verify that the TAXII2 server is returning valid STIX objects and that the observable types match the expected ingestion format.  Refer to Recommended STIX 2.x observable types and patterns for ES Threat Intelligence KV Store ingestion.

Additional Information : 

• For persistent issues, consult Splunk Support with log evidence and configuration details.

• Planning an upgrade path to ES 8.5 or later is recommended to permanently resolve this known issue with Threat Intelligence Management.