Where can I find cyber security related mock data for Splunk cloud and how I can I upload it?

[mike4860]

Hello,

We have a Splunk Cloud DEV environment and trying to upload some cyber security related mock data to test some detection logic. The mock data available in Splunk tutorial page (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchTutorial/Systemrequirements#Downloa...) is related with sales and prices which do not help. Some other mock data I found on GitHub pages are usually for Splunk Enterprise or on Premise which the data needs to be uploaded through reaching out the backend so it is not possible to upload BOTS or some other available data I found to Splunk Cloud. I would appreciate if anyone can help with this. Thank you. 

[PickleRick]

You can set up an attack range environment and generate such data yourself.

https://github.com/splunk/attack_range

The downside to using Splunk Cloud for such things compared to loading BOTS indexed data to your on-prem server is that you have to ingest that data to the Cloud first which consumes your license.

[meetmshah]

Hello @mike4860,

I have usually seen people taking either of the 2 approches - 

• Upload events from UI through tgz/csv etc.
• Use Eventgen (https://splunkbase.splunk.com/app/1924) on HF/UF to generate dummy events

Please hit Karma, if this helps!