Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Back to all walkthroughs
Room Icon

Splunk 3

Premium room

Part of the Blue Primer series. This room is based on version 3 of the Boss of the SOC (BOTS) competition by Splunk.

medium

45 min

6,811

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

This is the 4th room in this series. This room is based on Splunk's Boss of the competition, the third dataset (opens in new tab). 

You can read more about this dataset here (opens in new tab).

It is highly recommended that you complete the Splunk 101 and the BOTSv2 Splunk rooms before attempting this room. 

This room is designed with the assumption that you know the basics of Splunk and are comfortable querying various data sources. 

Room Machine

Before moving forward, deploy the Splunk lab machine.

From the AttackBox, open Firefox and navigate to the Splunk instance (http://MACHINE_IP:8000).

You may need to refresh the page until Splunk loads. This can take up to five minutes to launch. 

Answer the questions below
Deploy the lab machine and connect to the website found at MACHINE_IP:8000