Home

Awesome

Boss of the SOC (BOTS) Dataset Version 1

A sample security dataset and CTF platform for information security professionals, researchers, students, and enthusiasts. This page hosts information regarding the version 1 "Dataset." If you would like access to the CTF Scoreboard please visit the CTF Scoreboard github page.

Data Sourcetypes Included

Retrieving the BOTS v1 Dataset

The dataset is available in several formats:

Splunk Indexed

This is recommended way to explore and analyze the BOTS dataset.

Download the dataset from this location: botsv1_data_set.tgz (6.1GB compressed)

Alternatively, this collection represents a much smaller version of the original dataset containing only attack data. In other words, "just the needles, no haystack." botsv1-attack-only.tgz(135MB compressed)

The dataset requires the following software which is distributed and licensed separately and should be installed before using the dataset. The versions listed are those that were used to create the dataset. Different versions of the software may or may not work properly. If you are new to Splunk, follow these instructions to install the free Splunk Enterprise trial and these instructions to install apps and add-ons.

App / Add-onVersionDownload
Splunk Enterprise6.5.2http://www.splunk.com
Fortinet Fortigate Add-on for Splunk1.3https://splunkbase.splunk.com/app/2846
Splunk Add-on for Tenable5.0.0https://splunkbase.splunk.com/app/1710/
Splunk Stream Add-on (Note Stream 6.6.1 is no longer available. Use Version 7.1.1 instead.)6.6.1https://splunkbase.splunk.com/app/1809/
Splunk App for Stream (Note Stream 6.6.1 is no longer available. Use Version 7.1.1 instead.)6.6.1https://splunkbase.splunk.com/app/1809/
Splunk Add-on for Microsoft Windows4.8.3https://splunkbase.splunk.com/app/742/
TA-Suricata2.3https://splunkbase.splunk.com/app/2760/
Microsoft Sysmon Add-on3.2.3https://splunkbase.splunk.com/app/1914/
URL Toolbox1.6https://splunkbase.splunk.com/app/2734/

After installing Splunk, the botsv1_data_set app, and the apps/add-ons listed in the table above you can begin searching the data with the following Splunk Search Processing Languange (SPL):

index=botsv1 earliest=0

JSON - Complete

Download the JSON-formatted complete dataset from this location: botsv1.json.gz (11.3GB compressed, ~120GB uncompressed)

JSON - by Sourcetype

Splunk SourcetypeCompressed JSON file
WinEventLog:Applicationhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.WinEventLog-Application.json.gz
WinEventLog:Securityhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.WinEventLog-Security.json.gz
WinEventLog:Systemhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.WinEventLog-System.json.gz
XmlWinEventLog:Microsoft-Windows-Sysmon/Operationalhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.XmlWinEventLog-Microsoft-Windows-Sysmon-Operational.json.gz
fgt_eventhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.fgt_event.json.gz
fgt_traffichttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.fgt_traffic.json.gz
fgt_utmhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.fgt_utm.json.gz
iishttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.iis.json.gz
nessus:scanhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.nessus-scan.json.gz
stream:dhcphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-dhcp.json.gz
stream:dnshttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-dns.json.gz
stream:httphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-http.json.gz
stream:icmphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-icmp.json.gz
stream:iphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-ip.json.gz
stream:ldaphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-ldap.json.gz
stream:mapihttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-mapi.json.gz
stream:siphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-sip.json.gz
stream:smbhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-smb.json.gz
stream:snmphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-snmp.json.gz
stream:tcphttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-tcp.json.gz
suricatahttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.suricata.json.gz
winregistryhttps://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.winregistry.json.gz

CSV by Sourcetype

Splunk SourcetypeCompressed CSV file
WinEventLog:Applicationhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.WinEventLog%3AApplication.csv.gz
WinEventLog:Securityhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.WinEventLog%3ASecurity.csv.gz
WinEventLog:Systemhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.WinEventLog%3ASystem.csv.gz
XmlWinEventLog:Microsoft-Windows-Sysmon/Operationalhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.XmlWinEventLog%3AMicrosoft-Windows-Sysmon-Operational.csv.gz
fgt_eventhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.fgt_event.csv.gz
fgt_traffichttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.fgt_traffic.csv.gz
fgt_utmhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.fgt_utm.csv.gz
iishttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.iis.csv.gz
nessus:scanhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.nessus%3Ascan.csv.gz
stream:dhcphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Adhcp.csv.gz
stream:dnshttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Adns.csv.gz
stream:httphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Ahttp.csv.gz
stream:icmphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Aicmp.csv.gz
stream:iphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Aip.csv.gz
stream:ldaphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Aldap.csv.gz
stream:mapihttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Amapi.csv.gz
stream:siphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Asip.csv.gz
stream:smbhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Asmb.csv.gz
stream:snmphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Asnmp.csv.gz
stream:tcphttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Atcp.csv.gz
suricatahttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.suricata.csv.gz
winregistryhttps://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.winregistry.csv.gz

Warning

Please be advised that this dataset may contain profanity, slang, vulgar expressions, and/or generally offensive terminology. Please use with discretion.

This dataset contains evidence captured during actual computer security incidents, or from realistic lab recreations of security incidents. As such, the dataset may contain profanity, slang, vulgar expressions, and/or generally offensive terminology. The authors believe that the educational benefits of preserving the realism of the dataset outweigh the risk of offending some users. If the possibility of encountering this type of offensive material is a concern to you or to any audience with whom you plan to share the dataset, please stop now and do not continue.

Authors

Written in 2016 by Ryan Kovar, David Herrald, and James Brodsky

Copyright and License

To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty. You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see http://creativecommons.org/publicdomain/zero/1.0/.