> For the complete documentation index, see [llms.txt](https://botes.gitbook.io/botes-dataset/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://botes.gitbook.io/botes-dataset/master.md).

# Boss of the SOC (BOTS) Dataset

## Introduction

Boss of the SOC (BOTS) Datasets, are security event Datasets released by Splunk. 

BOTS Datasets contain multiple attack scenarios and are used during Blue Team CTF events along with a Scoring Server, released by Splunk too. 

BOTS Datasets can be use for :

* Detection rules testing.
* Ingestion and processing pipeline testing.
* Security events enrichements testing.
* Training.
* Many other things.

## Download

Multiple version of BOTS Dataset are available, in different formats (Splunk Pre-Index, JSON, CSV). Download links of original BOTS files can be found here :

**BOTSv1 :** [**https://github.com/splunk/botsv1**](https://github.com/splunk/botsv1)

**BOTSv2 :** [**https://github.com/splunk/botsv2**](https://github.com/splunk/botsv2)

**Scoring App (Require Splunk):** [**https://github.com/splunk/SA-ctf\_scoreboard**](https://github.com/splunk/SA-ctf_scoreboard)

## Additional resources

For training, here is a blog post containing tips for hunting with Splunk, tips also valid and reusable for hunting with Elastic : [**https://www.splunk.com/blog/2017/07/06/hunting-with-splunk-the-basics.html**](https://www.splunk.com/blog/2017/07/06/hunting-with-splunk-the-basics.html)