Getting error "internal Analyzer Failure"

[pavlos1982]

when trying analyze a case under observable tabs, I get the error "internal Analyzer Failure" see screensho[t, can anyone help, thanks]

[InfosecGoon]

It looks like you're trying to use the Spamhaus analyzer and it's not responding with useful information. Can you post the rest of the JSON response? Is it doing this for other IPs, or is 69.X.X.X just not in the Spamhaus database?

[pavlos1982]

Hi,

I have tested another IP that claims to be malware targetting one of my Mikrotik routers, again went to analyze it same result see the result with the JSON:

[pavlos1982]

I also got another error message that seems to be pointing to my internet DNS that all the routing has been done to access the internet see below:

[pavlos1982]

I have also tried to disable the EDR on the domain controller thinking it might be that blocking it but still same issue internal error

[InfosecGoon]

Definitely looks like an issue with the DNS server response you're getting for the Spamhaus query. Is there any kind of filtering or sinkholing of DNS lookups on your network that could be blocking the lookup?

[pavlos1982]

Hi, it is working for some other cases see below, but for some, it is not working, in relation to the DNS I am using CloudFlare DNS instead of my ISP, do you think this causes an issue? see the screenshot showing it is working

not working