Example data/incidents for ES

[MichalG1]

Hello Team,

I have my training Splunk instance with ES 7.1.

I have used it for training and experiments. Question: is there any "training/example" data i could use to import it there ? The point is: i do not want to configure dozens of TA's/collectors, create real labs with real cybersecurity attacks, instead would love to have a test data so i could learn/experiment/review Splunk ES capabilities.

Anything ?

[PickleRick · Accepted solution]

You can use BOTS dataset

https://github.com/splunk/botsv3

[MichalG1]

Looks great, will test it, thx !

[gcusello]

Hi @MichalG1,

have you access to Splunk Show (show.splunk.com)?

if yes, you already have a complete environment for test and training with all the installed add-ons and data.

Otherwise, it's really difficoult to create a relevant data test environment.

Ciao.

Giuseppe

[MichalG1]

I can login there (using my instructor account), but see 0 events (both public and invited), any way to get the access there ? Thanks @gcusello !