This article explains why Adaptive Threat Profiling feeds fail to work when Policy Enforcer is being used
The plan is to implement a custom IDP policy with custom IDP signatures designed to trigger updates to the ATP feed.
Although the IDP is being triggered and events indicate that attacker target IPs are being added to the ATP Feed, these IPs do not appear in the ATP Portal.
From the SecIntel traceoptions, we observed that the SRX device is correctly forwarding traffic to the PE. However, the PE responds with a 404 Not Found error.
Jul 24 08:30:24 Post https://10.219.156.100/api/customdata/... to server, try 1 times Jul 24 08:30:25 Post https://10.219.156.100/api/customdata/... to server, try 2 times Jul 24 08:30:26 Post https://10.219.156.100/api/customdata/... to server, try 3 times Jul 24 08:30:27 File /var/db/secinteld/upload/root-logical-system_junos-default-vrf_ip_WP_Test_Feed.txt post : 0.015625 seconds, response: Jul 24 08:30:27 Post file /var/db/secinteld/upload/root-logical-system_junos-default-vrf_ip_WP_Test_Feed.txt failed Jul 24 08:30:27 sec_profiling_ip_feed_post: uri_path: /api/customdata/..., status: <html><title>404: Not Found</title><body>404: Not Found</body></html>, conn_code: 0, http_code: 404, ret: -3, post_flag: 0
This is a known issue with the PE.The fix for this issue is included in Junos version 23.1 Hot Patch v3.