Alerting

Is it possible to Run a script on Universal Forwarder by an alert?

raffaelecervino
Engager

Hi,

I've installed Splunk Trial Enterprise on a server and Universal Forwarder on other three servers (with Ubuntu) that sends me logs.

I want to create an alert for a specific use case. This alert has to send a notify and run a script on the server where the alert was triggered. Is that possible? 

Thanks

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

its possible to allow e.g. ssh access from splunk server to UF and define in sudoers what you want to run and how. Is it wise in security point of view could be little bit different story.

Another option is take Splunk SOAR (ex-Phantom) into use and use it's playbook to do it after alert has fired. At least earlier there was an open source version (limited amount of exections etc.) for testing and starting use. 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...