Splunk Search

Installing Boss of the SOC (BOTS) Investigation Workshop

therevenant
New Member

Despite the number of links:
https://www.splunk.com/blog/2018/05/25/boss-of-the-soc-bots-investigation-workshop-for-splunk.html

One first installs the app:

https://splunkbase.splunk.com/app/3985/

You are then directed to Copy/Move the entire extracted BOTS directory into the $SPLUNK_HOME/etc/apps directory.

How can I find the exact path for my own environment? This directory does not appear to exist.

and secondly the dataset:

http://explore.splunk.com/BOTS_1_0_datasets

For which you must register. It will take you to a GitHub link. Then what?

Tags (1)
0 Karma

mstephenson716
Explorer

I believe that by default the home paths, if you didn't customize your installation are:

Windows
C:\Program Files\Splunk

e.g., C:\Program Files\Splunk\etc\apps

Linux
/opt/splunk

e.g., /opt/splunk/etc/apps

So if I'm, understanding correctly, you would put that app in one of these directories.

Where the BOTS1.0 data set is concerned you would install the prerequisite apps, download the data that you want to explore, either the attack only or the full data set. I would recommend, like they do, using the app pre-indexed data set. Also extract this app and place it in the apps folder, and restart Splunk.

You should then be able to find the data in the Search app by searching:

index=botsv1 earliest=0

**edited to answer both questions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...