Is it possible to Run a script on Universal Forwarder by an alert?

[raffaelecervino]

Hi,

I've installed Splunk Trial Enterprise on a server and Universal Forwarder on other three servers (with Ubuntu) that sends me logs.

I want to create an alert for a specific use case. This alert has to send a notify and run a script on the server where the alert was triggered. Is that possible? 

Thanks

[isoutamo]

Hi

its possible to allow e.g. ssh access from splunk server to UF and define in sudoers what you want to run and how. Is it wise in security point of view could be little bit different story.

Another option is take Splunk SOAR (ex-Phantom) into use and use it's playbook to do it after alert has fired. At least earlier there was an open source version (limited amount of exections etc.) for testing and starting use. 

r. Ismo