Advanced Threat Analytics - Malicious Threat Feed Status displays "Failed"
Issue description
In Advanced Threat Analytics, the Malicious Threat Feed status will show as "Failed" if EventLog Analyzer is unable to communicate with Log360Cloud Threat feed server to retrieve the latest threat feed data.
When this happens, the status of the configured Malicious Threat Feed will display a message indicating that the connection to Log360Cloud has failed.
Prerequisites
- Please ensure that the EventLog Analyzer server has a working internet connection and the server can communicate with log360 cloud Threat feed server. We recommend whitelisting the below URLs to establish a connection to Threat Server without being blocked by the firewall
- log360feeds.manageengine.com
- log360cloud.manageengine.com
- creator.zoho.com
- creatorapp.zohopublic.com
- Ensure that the below folders mentioned here are excluded from AntiVirus scan
Possible causes
- Case 1: Communication Restriction.
This error occurs when EventLog Analyzer is unable to communicate with the Threat Server due to firewall restrictions. - Case 2: DNS Resolver Issue.
The machine could not resolve the domain using its DNS resolver. - Case 3: File Corruption. This error can occur if there is file corruption on the server where EventLog Analyzer is installed.
Resolution
- Case 1: Communication Error
- Login to the EventLog Analyzer installed server.
- Open browser and try accessing the below URLs.
- log360feeds.manageengine.com
- log360cloud.manageengine.com
If you can access the above mentioned URLs, then the communication is in place.
- If these URLs could not be accessed, kindly allow these URLs in the Firewall and Proxy servers (If Applicable).
- You can confirm this by using the below powershell command
Test-NetConnection log360cloud.manageengine.com -port 443 - Case 2: Unable to resolve DNS
Step 1: Use nslookup to Test DNS Resolution
Try to resolve the domain name using a command line tool such as nslookup to confirm that the DNS resolution is failing.
- nslookup log360cloud.manageengine.com
- nslookup log360feeds.manageengine.com
If DNS is working, you should see:
If DNS is failing:
You may see:
*** Can't find log360cloud.manageengine.com: Non-existent domain
or
*** DNS request timed out
Step 2: If NS look up fails Try with a Public DNS Server
To rule out issues with your current DNS server,
try:
nslookup log360cloud.manageengine.com 8.8.8.8( Where 8.8.8.8 is Google DNS)
If this is the case, then it is recommended to validate your DNS server and DNS records.
Case 3: File Corruption
- If the EventLog Analyzer folders are not excluded from antivirus scans, the antivirus may corrupt configuration files, which can lead to communication issues.
- Please ensure to exclude the EventLog Analyzer folders from the AV scan.
- If there are no issues with the Case 1 and 2, please click on the "Synchronize Now" in the Advanced Threat Analytics page and check if you are still facing the issue.
- If the issue still persists, kindly reach out to the EventLog Analyzer Support Team.
Related topics and articles
How to reach support
New to ADSelfService Plus?
Related Articles
How to add Cyware Threat Intelligence Platform as a threat feed manager in EventLog Analyzer
Objective It is essential to have multiple threat feed managers integrated with a SIEM solution to detect threats in the production environment. This article focuses on how to add Cyware Threat Intelligence Platform as a threat feed manager in ...How to add Sectrio Threat Intelligence as threat feed manager in EventLog Analyzer?
Objective It is essential to have multiple threat feed managers integrated with a SIEM solution to detect the threats in the production environment. This article focuses on how to add Sectrio Threat Intelligence as a threat feed manager in EventLog ...Troubleshooting: Invalid access key error while configuring Advanced Threat Analytics in EventLog Analyzer
Issue description This issue occurs while configuring Advanced Threat Analytics in EventLog Analyzer. Possible cause EventLog Analyzer build is lower than 12550. The access key may not copy correctly if the browser is zoomed in and a scroll-bar ...How to add Kaspersky Threat Intelligence as threat feed manager in EventLog Analyzer
Objective It's essential to have multiple threat feed managers integrated with a SIEM solution to detect threats in the production environment. This article shows you how to add Kaspersky Threat Intelligence as a threat feed manager in EventLog ...How to add Pulsedive Threat Intelligence as a threat feed manager in EventLog Analyzer
Objective It's essential to have multiple threat feed managers integrated with a SIEM solution to detect threats in the production environment. This article shows you how to add Pulsedive Threat Intelligence as a threat feed manager in EventLog ...