Dell Trusted Device Installation and Administrator Guide v5.5

Configure to forward data to a SIEM solution

SIEM solutions often require a utility to consume data sources. The Splunk universal forwarder is a lightweight forwarding solution that can be configured for use with the Event Repository during or after installation. The following example provides installation and configuration reference for the Splunk universal forwarder to push data from Event Repository to a Splunk SIEM instance.

Use one of the following articles to install a universal forwarder based on the environment in which your Event Repository is installed:

• To install a universal forwarder on Windows, see this Splunk article.
• To install a universal forwarder on Linux, Solaris, macOS, FreeBSD, or AIX, see this Splunk article.

After installation, see this Splunk article to configure the universal forwarder for use with the Event Repository.

After Docker is installed and prerequisites are configured, go to Run the Event Repository.