Splunk Enterprise Security

How to implement a two factor authentication (2FA) to collect external feeds from a threat intelligence provider to Splunk Enterprise Security?

sreejith2k2
Explorer

Currently one of the threat intelligence providers gives us an API link to download the threat feeds. But they are planning to change it to the two factor authentication (username, password and certificate). Also, their URL changes everyday.

My Questions:

  1. How can I implement two factor authentication to collect the external feeds from our provider to our Enterprise Security?
  2. If I write a script to generate a URL everyday, how can I make sure that scripts run from Search Head Captain (ours is a SH and Indexer clustered environment) to download the CSV file into the app?
0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

ES does support certificate-based authentication for TAXII feeds, as long as that is what the format is. See instructions here: http://docs.splunk.com/Documentation/ES/4.2.1/User/Configureblocklists#Add_a_TAXII_feed_with_certifi...

I can't comment on #2, but I'd presume that it's something you could work out withe some form of a modular input.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...