How to implement a two factor authentication (2FA) to collect external feeds from a threat intelligence provider to Splunk Enterprise Security?

[sreejith2k2]

Currently one of the threat intelligence providers gives us an API link to download the threat feeds. But they are planning to change it to the two factor authentication (username, password and certificate). Also, their URL changes everyday.

My Questions:

1. How can I implement two factor authentication to collect the external feeds from our provider to our Enterprise Security?
2. If I write a script to generate a URL everyday, how can I make sure that scripts run from Search Head Captain (ours is a SH and Indexer clustered environment) to download the CSV file into the app?

[smoir_splunk]

ES does support certificate-based authentication for TAXII feeds, as long as that is what the format is. See instructions here: http://docs.splunk.com/Documentation/ES/4.2.1/User/Configureblocklists#Add_a_TAXII_feed_with_certifi...

I can't comment on #2, but I'd presume that it's something you could work out withe some form of a modular input.