Splunk 2

BOTSv2 Dataset:

The data included in this app was generated in August of 2017 by members of Splunk's Security Specialist team - Dave Herrald, Ryan Kovar, Steve Brant, Jim Apger, John Stoner, Ken Westin, David Veuve and James Brodsky. They stood up a few lab environments connected to the Internet. Within the environment they had a few Windows endpoints instrumented with the Splunk Universal Forwarder and Splunk Stream. The forwarders were configured with best practices for Windows endpoint monitoring, including a full Microsoft Sysmon deployment and best practices for Windows Event logging. The environment included a Palo Alto Networks next-generation firewall to capture traffic and provide web proxy services, and Suricata to provide network-based IDS. 

Note: This information is from the Advanced Hunting APTs with Splunk app. 

BOTSv2 Github: https://github.com/splunk/botsv2 (opens in new tab)

It is recommended that you complete the Splunk 101 room before attempting this room. 

Room Machine

Before moving forward, deploy the Splunk virtual machine.

From the AttackBox, open Firefox Web Browser and navigate to the Splunk instance (http://MACHINE_IP:8000).

You may need to refresh the page until Splunk loads. This can take up to five minutes to launch.