Splunk SOAR (formerly Phantom) does not natively run on Windows servers as it is primarily
designed for Linux environments. However, it can be deployed on a Windows server through
virtualization. By running the Phantom OVA (Open Virtualization Appliance) as a virtual machine,
users can utilize virtualization platforms like VMware or VirtualBox on a Windows server to host the
Phantom environment. This approach allows for the deployment of Phantom in a Windows-centric
infrastructure by leveraging virtualization technology to encapsulate the Phantom application within
a supported Linux environment provided by the OVA.
