Alerting

Is it possible to Run a script on Universal Forwarder by an alert?

raffaelecervino
Engager

Hi,

I've installed Splunk Trial Enterprise on a server and Universal Forwarder on other three servers (with Ubuntu) that sends me logs.

I want to create an alert for a specific use case. This alert has to send a notify and run a script on the server where the alert was triggered. Is that possible? 

Thanks

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

its possible to allow e.g. ssh access from splunk server to UF and define in sudoers what you want to run and how. Is it wise in security point of view could be little bit different story.

Another option is take Splunk SOAR (ex-Phantom) into use and use it's playbook to do it after alert has fired. At least earlier there was an open source version (limited amount of exections etc.) for testing and starting use. 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...