Splunk Search

Splunk BOTSv3 help

splunkbegineer
New Member

Hello Everyone,

I am starting my investigation after completion of the BOTSv1 and 2. When it comes to BOTSv3, it is talking about cloud incident. I have been thinking of how to perform reconnaissance. I have learnt the reconnaissance in BOTSv1 and 2 but when it come to BOTSv3, it is more different. I am aware that BOTSv3 provide the CTF questions to visualize the timeline of the attacks.  May I kindly know on whether is there another way to visualize  the  the attack series using the MITRE Attack Framework and the Lockheed Martin Cyber Kill Chain, and  timeline of the critical events for this BOTSv3.

Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control
Actions on objectives

Could you kindly help?

Thank you

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...