Boss of the SOC (BOTS) Dataset Version 1
A sample security dataset and CTF platform for information security professionals, researchers, students, and enthusiasts. This page hosts information regarding the version 1 "Dataset." If you would like access to the CTF Scoreboard please visit the CTF Scoreboard github page.
Data Sourcetypes Included
- WinEventLog:Application
- WinEventLog:Security
- WinEventLog:System
- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- fgt_event
- fgt_traffic
- fgt_utm
- iis
- nessus:scan
- stream:dhcp
- stream:dns
- stream:http
- stream:icmp
- stream:ip
- stream:ldap
- stream:mapi
- stream:sip
- stream:smb
- stream:snmp
- stream:tcp
- suricata
- winregistry
Retrieving the BOTS v1 Dataset
The dataset is available in several formats:
Splunk Indexed
This is recommended way to explore and analyze the BOTS dataset.
Download the dataset from this location: botsv1_data_set.tgz (6.1GB compressed)
Alternatively, this collection represents a much smaller version of the original dataset containing only attack data. In other words, "just the needles, no haystack." botsv1-attack-only.tgz(135MB compressed)
The dataset requires the following software which is distributed and licensed separately and should be installed before using the dataset. The versions listed are those that were used to create the dataset. Different versions of the software may or may not work properly. If you are new to Splunk, follow these instructions to install the free Splunk Enterprise trial and these instructions to install apps and add-ons.
| App / Add-on | Version | Download |
|---|---|---|
| Splunk Enterprise | 6.5.2 | http://www.splunk.com |
| Fortinet Fortigate Add-on for Splunk | 1.3 | https://splunkbase.splunk.com/app/2846 |
| Splunk Add-on for Tenable | 5.0.0 | https://splunkbase.splunk.com/app/1710/ |
| Splunk Stream Add-on (Note Stream 6.6.1 is no longer available. Use Version 7.1.1 instead.) | 6.6.1 | https://splunkbase.splunk.com/app/1809/ |
| Splunk App for Stream (Note Stream 6.6.1 is no longer available. Use Version 7.1.1 instead.) | 6.6.1 | https://splunkbase.splunk.com/app/1809/ |
| Splunk Add-on for Microsoft Windows | 4.8.3 | https://splunkbase.splunk.com/app/742/ |
| TA-Suricata | 2.3 | https://splunkbase.splunk.com/app/2760/ |
| Microsoft Sysmon Add-on | 3.2.3 | https://splunkbase.splunk.com/app/1914/ |
| URL Toolbox | 1.6 | https://splunkbase.splunk.com/app/2734/ |
After installing Splunk, the botsv1_data_set app, and the apps/add-ons listed in the table above you can begin searching the data with the following Splunk Search Processing Languange (SPL):
index=botsv1 earliest=0
JSON - Complete
Download the JSON-formatted complete dataset from this location: botsv1.json.gz (11.3GB compressed, ~120GB uncompressed)
JSON - by Sourcetype
CSV by Sourcetype
Warning
Please be advised that this dataset may contain profanity, slang, vulgar expressions, and/or generally offensive terminology. Please use with discretion.
This dataset contains evidence captured during actual computer security incidents, or from realistic lab recreations of security incidents. As such, the dataset may contain profanity, slang, vulgar expressions, and/or generally offensive terminology. The authors believe that the educational benefits of preserving the realism of the dataset outweigh the risk of offending some users. If the possibility of encountering this type of offensive material is a concern to you or to any audience with whom you plan to share the dataset, please stop now and do not continue.
Authors
Written in 2016 by Ryan Kovar, David Herrald, and James Brodsky
Copyright and License
To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty. You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see http://creativecommons.org/publicdomain/zero/1.0/.