# OTX threat fields empty in v2.4.4

**URL:** <https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341>\
**Category:** Graylog Central (peer support)\
**Created:** [May 24, 2018, 5:25pm UTC](https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341 "2018-05-24T17:25:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sapplega](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@sapplega](https://community.graylog.org/u/sapplega)\
**Post date:** [May 24, 2018, 5:25pm UTC](https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341/1 "2018-05-24T17:25:26Z")

</div>

Just upgraded to Graylog 2.4.4 to get the new “Threat Intel Plugin”. When I run the otx\_lookup\_ip function, I sometimes receive a otx\_threat\_indicated:true returned, but the ids and names fields are blank. Is there something else I need to do after upgrading to fix this?

My pipeline rule code:  
let otx\_intel = otx\_lookup\_ip(to\_string($message.client\_ip));  
set\_field(“OTX\_Intel”, otx\_intel);

Sample returned info:  
OTX\_Intel  
{“otx\_threat\_indicated”:true,“otx\_threat\_ids”:"",“otx\_threat\_names”:""}

My running version:  
Graylog 2.4.4+4659dbe (Oracle Corporation 1.8.0\_171 on Linux 3.10.0-862.3.2.el7.x86\_64)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 24, 2018, 5:32pm UTC](https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341/2 "2018-05-24T17:32:14Z")

</div>

Which exact version of the Threat Intel Plugin are you using?  
[https://github.com/Graylog2/graylog-plugin-threatintel/pull/99](https://github.com/Graylog2/graylog-plugin-threatintel/pull/99)

---

<div class="post-metadata">

**Author:** ![sapplega](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@sapplega](https://community.graylog.org/u/sapplega)\
**Post date:** [May 24, 2018, 6:33pm UTC](https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341/3 "2018-05-24T18:33:14Z")

</div>

From /usr/share/graylog-server/plugin/ directory:  
4574712 May 2 09:41 graylog-plugin-threatintel-2.4.4.jar

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 25, 2018, 6:43am UTC](https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341/4 "2018-05-25T06:43:43Z")

</div>

Which version is shown on the System / Nodes / Details page?

---

<div class="post-metadata">

**Author:** ![sapplega](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@sapplega](https://community.graylog.org/u/sapplega)\
**Post date:** [May 25, 2018, 11:57am UTC](https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341/5 "2018-05-25T11:57:13Z")

</div>

Details page shows v2.4.4

The problem is resolved now. I changed the rules code to look like this, and it’s working:

```
let otx_intel = otx_lookup_ip(to_string($message.client_ip));
set_fields(otx_intel);
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 8, 2018, 11:57am UTC](https://community.graylog.org/t/otx-threat-fields-empty-in-v2-4-4/5341/6 "2018-06-08T11:57:20Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.