Splunk Enterprise Security

How to implement a two factor authentication (2FA) to collect external feeds from a threat intelligence provider to Splunk Enterprise Security?

sreejith2k2
Explorer

Currently one of the threat intelligence providers gives us an API link to download the threat feeds. But they are planning to change it to the two factor authentication (username, password and certificate). Also, their URL changes everyday.

My Questions:

  1. How can I implement two factor authentication to collect the external feeds from our provider to our Enterprise Security?
  2. If I write a script to generate a URL everyday, how can I make sure that scripts run from Search Head Captain (ours is a SH and Indexer clustered environment) to download the CSV file into the app?
0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

ES does support certificate-based authentication for TAXII feeds, as long as that is what the format is. See instructions here: http://docs.splunk.com/Documentation/ES/4.2.1/User/Configureblocklists#Add_a_TAXII_feed_with_certifi...

I can't comment on #2, but I'd presume that it's something you could work out withe some form of a modular input.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...