What do you mean by "configure rules for BOTS dataset"?
The BOTS dataset comes as preindexed buckets which can cause issues.
It's pre-indexed which means it's already indexed "into the past". This means that your scheduled searches spawned by correlation rules which are by default searching through last X minutes or hours worth of data will not match anything simply because the events are already in the past. That's one thing - you'd have to manually search through a time range in the past.
Another potential thing (but I've never used the BOTS datasets so I'm not sure what they look like inside; it's just speculating) could be if they were just raw indexed data without the accelerated datamodel summaries. That would make searches running from datamodels with summariesonly=t not find any results. And as the events are indexed in the past it would affect DAS building and retention.
