topic Re: Where can I find cyber security related mock data for Splunk cloud and how I can I upload it? in Getting Data In

Where can I find cyber security related mock data for Splunk cloud and how I can I upload it?

mike4860 — Sat, 29 Jul 2023 17:01:28 GMT

Hello,

We have a Splunk Cloud DEV environment and trying to upload some cyber security related mock data to test some detection logic. The mock data available in Splunk tutorial page (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchTutorial/Systemrequirements#Download_the_tutorial_data_files) is related with sales and prices which do not help. Some other mock data I found on GitHub pages are usually for Splunk Enterprise or on Premise which the data needs to be uploaded through reaching out the backend so it is not possible to upload BOTS or some other available data I found to Splunk Cloud. I would appreciate if anyone can help with this. Thank you.

Re: Where can I find cyber security related mock data for Splunk cloud and how I can I upload it?

meetmshah — Mon, 31 Jul 2023 20:28:38 GMT

Hello @mike4860,

I have usually seen people taking either of the 2 approches -

Upload events from UI through tgz/csv etc.
Use Eventgen (https://splunkbase.splunk.com/app/1924) on HF/UF to generate dummy events

Please hit Karma, if this helps!

Re: Where can I find cyber security related mock data for Splunk cloud and how I can I upload it?

PickleRick — Mon, 31 Jul 2023 20:36:58 GMT

You can set up an attack range environment and generate such data yourself.

https://github.com/splunk/attack_range

The downside to using Splunk Cloud for such things compared to loading BOTS indexed data to your on-prem server is that you have to ingest that data to the Cloud first which consumes your license.