How to process BOTS data?

[zakaria1996-cyb]

Hi everyone,

I'm working with the botsv1 attack-only dataset and I need some guidance on how to approach a few SPL tasks. The dataset is available here:
https://s3.amazonaws.com/botsdataset/botsv1/botsv1-attack-only.tgz

I want to learn how to do the following:

1. Find the 10 most requested domains in the DNS traffic.

2. Identify which calendar day in the dataset has the highest HTTP traffic volume.

3. Create a line chart that shows data volume over time.

I'm mainly looking for advice on how to structure the searches and how to approach the analysis step-by-step.

Thanks in advance.

[livehybrid]

Hi @zakaria1996-cyb 

This looks like the same question asked by another user earlier this week, please find the answer below.

https://community.splunk.com/t5/Splunk-Search/o/m-p/755834

1. Find the top 10 most requested domains in DNS traffic

index=yourIndex sourcetype=stream:dns | top 10 query

(This assumes the query field contains the DNS query being made - its been a while since Ive used this dataset!)

2. Identify which day in the dataset has the highest HTTP traffic volume

index=yourIndex sourcetype=stream:http | stats sum(bytes) as http_volume by date_mday | sort - http_volume | head 1

(This assumes the HTTP events contain a field named bytes with the traffic size. date_mday is the day of the month. If you need the full date you could use:

index=yourIndex sourcetype=stream:http | bin span=1d _time | stats sum(bytes) as http_volume by _time | sort - http_volume | head 1

3. Create a line chart showing data volume over time

I dont know which sourcetype this is in but you could do something like:

index=yourIndex | timechart span=1h sum(bytes) AS TotalDataVolume

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing