BOTS 2.0 scoreboard server setup

[ptlopes]

hello all,

I belong to a SoC ans qe are testing several SIEM Solutions. The best way that we could find to become ourselfs comfortable with Splunk it is the BOTS appoach.

Now, refering to the score app when i follow the steps at https://github.com/splunk/SA-ctf_scoreboard when i get to step 11

Confirm the custom controller came up properly:

ls -l $SPLUNK_HOME/var/log/scoreboard
-rw------- 1 splunk staff 59 Sep 2 14:26 scoreboard.log
-rw------- 1 splunk staff 59 Sep 2 14:26 scoreboard_admin.log

i don't have the *.log files, can you help please

Thank you in advence,
PTL

[ptlopes]

Hello Skalli,

Like you said i made the setup with sugested version, Splunk 7.1.1, and everything is working like expected.

Thank you very much for your help,
PTL

[ndias_splunk]

Just a thought, if you're planning on using/testing Splunk Enterprise Security with BOTS, you'll need at least Splunk 7.2.8 to work with ES 6.0.

HTH!

[skalliger]

Thank you for your feedback. 🙂

[ndias_splunk · Accepted solution]

@skalliger is likely on target with the comment about Splunk versions. Having just went through this myself, I'm going to say it's likely the Splunk version and Python 3 that is biting you. See if you have log entries that look like this:

"ImportError: No module named 'ConfigParser'"

I'm going to guess that you do.

Since you're testing and not version dependent, just install Splunk 7.3.4 and you should be good to go.

https://www.splunk.com/page/previous_releases

[skalliger]

What steps have you done and checked? Did you follow the instructions step by step? That's very important otherwise it's easy to miss a step, like creating the log directory first. Did you copy the default controller config to the correct directory?
Also make sure you're only using the recommended Splunk Enterprise version as newer versions might not be working.

Skalli

[ptlopes]

Hello Skalli,

Thak you for your update. I followed all the steps including the controller config copy. Probably it is because of the splunk version... I installed the latest one 8.0.1.

I will try another one and return feedback

thank you,
PTL