Troubleshooting Tip: How to fix invalid pattern issue while fetching the feeds using TAXII protocol from FortiSOAR

'Fortinet FortiGuard Threat Intelligence' data ingestion gets configured automatically while installing the 'Threat Intel Management' solution pack on the FortiSOAR system.

As a result, 'Fortinet FortiGuard Threat Intelligence' data ingestions playbooks get created which contain a jinja value '{{vars.item.pattern | toJSON}}' This leads to incorrect characters being added to the pattern field when creating the 'Threat Intel Feeds' record in FortiSOAR.

Follow the below steps to fix this:

1. Navigate to Automation -> Playbooks -> Enable 'Include System Collection' -> Search for 'Fortinet FortiGuard Threat Intelligence'.
   
   
2. Select the below collection:
   
   Fortinet FortiGuard Threat Intelligence 3.1.0 config2Ingestion(e02562a9-a719-4081-ac83-3dfebbb66422)(2)
   
   
3. Edit '-> FortiGuard Threat Intelligence -> Fetch and Create' playbook.
   
   
4. Edit the 'Create Record' step -> Replace the jinja as below in the pattern field -> Save the playbook.
   
   Pattern: {{vars.item.pattern}}