Splunk Search

Installing Boss of the SOC (BOTS) Investigation Workshop

therevenant
New Member

Despite the number of links:
https://www.splunk.com/blog/2018/05/25/boss-of-the-soc-bots-investigation-workshop-for-splunk.html

One first installs the app:

https://splunkbase.splunk.com/app/3985/

You are then directed to Copy/Move the entire extracted BOTS directory into the $SPLUNK_HOME/etc/apps directory.

How can I find the exact path for my own environment? This directory does not appear to exist.

and secondly the dataset:

http://explore.splunk.com/BOTS_1_0_datasets

For which you must register. It will take you to a GitHub link. Then what?

Tags (1)
0 Karma

mstephenson716
Explorer

I believe that by default the home paths, if you didn't customize your installation are:

Windows
C:\Program Files\Splunk

e.g., C:\Program Files\Splunk\etc\apps

Linux
/opt/splunk

e.g., /opt/splunk/etc/apps

So if I'm, understanding correctly, you would put that app in one of these directories.

Where the BOTS1.0 data set is concerned you would install the prerequisite apps, download the data that you want to explore, either the attack only or the full data set. I would recommend, like they do, using the app pre-indexed data set. Also extract this app and place it in the apps folder, and restart Splunk.

You should then be able to find the data in the Search app by searching:

index=botsv1 earliest=0

**edited to answer both questions.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...