diff --git a/modules/splunk/auto_values.tf b/modules/splunk/auto_values.tf
index 1f1138f1..898585b6 100644
--- a/modules/splunk/auto_values.tf
+++ b/modules/splunk/auto_values.tf
@@ -6,7 +6,7 @@
 variable "auto_ingress_rules" {
   description = "List of ingress rules to add automatically"
   type        = "list"
-  default     = ["splunk-indexer-tcp", "splunk-clients-tcp", "splunk-splunkd-tcp"]
+  default     = ["splunk-indexer-tcp", "splunk-clients-tcp", "splunk-splunkd-tcp", "splunk-hec-tcp"]
 }
 
 variable "auto_ingress_with_self" {
diff --git a/rules.tf b/rules.tf
index edc158e2..6d17dbb4 100644
--- a/rules.tf
+++ b/rules.tf
@@ -108,6 +108,7 @@ variable "rules" {
     splunk-indexer-tcp = [9997, 9997, "tcp", "Splunk indexer"]
     splunk-clients-tcp = [8080, 8080, "tcp", "Splunk clients"]
     splunk-splunkd-tcp = [8089, 8089, "tcp", "Splunkd"]
+    splunk-hec-tcp = [8088, 8088, "tcp", "Splunk HEC"]
 
     # Squid
     squid-proxy-tcp = [3128, 3128, "tcp", "Squid default proxy"]
@@ -291,7 +292,7 @@ variable "auto_groups" {
     }
 
     splunk = {
-      ingress_rules     = ["splunk-indexer-tcp", "splunk-clients-tcp", "splunk-splunkd-tcp"]
+      ingress_rules     = ["splunk-indexer-tcp", "splunk-clients-tcp", "splunk-splunkd-tcp", "splunk-hec-tcp"]
       ingress_with_self = ["all-all"]
       egress_rules      = ["all-all"]
     }