Hardware and software requirements for the Splunk Add-on for OSSEC

Splunk admin requirements

To install and configure the Splunk Add-on for OSSEC, you must be member of the admin or sc_admin role.

OSSEC setup requirements

You must have access to the OSSEC installation directory so that you can configure your OSSEC server to send alert data to the Splunk platform over syslog.

Splunk platform requirements

Because this add-on runs on the Splunk platform, all of the system requirements apply for the Splunk software that you use to run this add-on.

• For Splunk Enterprise system requirements: see "System Requirements" in the Installation Manual in the Splunk Enterprise documentation.
• If you are managing on-premises forwarders to get data in to Splunk Cloud, see "System Requirements" in the Installation Manual in the Splunk Enterprise documentation, which includes information about forwarders.