{"id":13454041,"url":"https://github.com/splunk/botsv1","last_synced_at":"2025-10-11T09:57:15.455Z","repository":{"id":66165969,"uuid":"130784779","full_name":"splunk/botsv1","owner":"splunk","description":null,"archived":false,"fork":false,"pushed_at":"2024-08-08T15:20:21.000Z","size":27,"stargazers_count":384,"open_issues_count":1,"forks_count":88,"subscribers_count":50,"default_branch":"master","last_synced_at":"2025-03-24T05:37:53.435Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/splunk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-04-24T02:29:32.000Z","updated_at":"2025-03-22T17:10:15.000Z","dependencies_parsed_at":null,"dependency_job_id":"20cb446e-0e16-4148-9078-ddcf80a29d8c","html_url":"https://github.com/splunk/botsv1","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/splunk/botsv1","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Fbotsv1","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Fbotsv1/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Fbotsv1/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Fbotsv1/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/splunk","download_url":"https://codeload.github.com/splunk/botsv1/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Fbotsv1/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279006747,"owners_count":26084185,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-11T02:00:06.511Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T08:00:50.519Z","updated_at":"2025-10-11T09:57:15.410Z","avatar_url":"https://github.com/splunk.png","language":null,"readme":"\n\n# Boss of the SOC (BOTS) Dataset Version 1\nA sample security dataset and CTF platform for information security professionals, researchers, students, and enthusiasts. This page hosts information regarding the version 1 \"Dataset.\" If you would like access to the [CTF Scoreboard](https://github.com/splunk/SA-ctf_scoreboard) please visit [the CTF Scoreboard github page.](https://github.com/splunk/SA-ctf_scoreboard)\n\n## Data Sourcetypes Included\n* WinEventLog:Application\n* WinEventLog:Security\n* WinEventLog:System\n* XmlWinEventLog:Microsoft-Windows-Sysmon/Operational\n* fgt_event\n* fgt_traffic\n* fgt_utm\n* iis\n* nessus:scan\n* stream:dhcp\n* stream:dns\n* stream:http\n* stream:icmp\n* stream:ip\n* stream:ldap\n* stream:mapi\n* stream:sip\n* stream:smb\n* stream:snmp\n* stream:tcp\n* suricata\n* winregistry\n\n## Retrieving the BOTS v1 Dataset\nThe dataset is available in several formats:\n### Splunk Indexed\n\nThis is recommended way to explore and analyze the BOTS dataset.\n\nDownload the dataset from this location: [botsv1_data_set.tgz](https://s3.amazonaws.com/botsdataset/botsv1/splunk-pre-indexed/botsv1_data_set.tgz) (6.1GB compressed)\n\nAlternatively, this collection represents a much smaller version of the original dataset containing only attack data. In other words, \"just the needles, no haystack.\" [botsv1-attack-only.tgz](https://s3.amazonaws.com/botsdataset/botsv1/botsv1-attack-only.tgz)(135MB compressed)\n\nThe dataset requires the following software which is distributed and licensed separately\nand should be installed before using the dataset. The versions listed are\nthose that were used to create the dataset. Different versions of the software\nmay or may not work properly. If you are new to Splunk, follow [these instructions](http://docs.splunk.com/Documentation/Splunk/7.0.0/Installation/Whatsinthismanual) to install the free Splunk Enterprise trial and [these instructions](https://docs.splunk.com/Documentation/AddOns/released/Overview/Singleserverinstall) to install apps and add-ons. \n\n| App / Add-on | Version | Download |\n| ----------- | ------- | -------- |\n| Splunk Enterprise | 6.5.2 | http://www.splunk.com\n| Fortinet Fortigate Add-on for Splunk | 1.3 |https://splunkbase.splunk.com/app/2846\n| Splunk Add-on for Tenable |5.0.0 | https://splunkbase.splunk.com/app/1710/ |Note v5.0.0 is no longer publicly available. Use v5.1.1 instead.\n| Splunk Stream Add-on (Note Stream 6.6.1 is no longer available. Use Version 7.1.1 instead.) | 6.6.1 |https://splunkbase.splunk.com/app/1809/ \n| Splunk App for Stream (Note Stream 6.6.1 is no longer available. Use Version 7.1.1 instead.) | 6.6.1 | https://splunkbase.splunk.com/app/1809/\n| Splunk Add-on for Microsoft Windows | 4.8.3 | https://splunkbase.splunk.com/app/742/\n| TA-Suricata | 2.3 | https://splunkbase.splunk.com/app/2760/\n| Microsoft Sysmon Add-on | 3.2.3 | https://splunkbase.splunk.com/app/1914/\n| URL Toolbox | 1.6 |https://splunkbase.splunk.com/app/2734/\n\nAfter installing Splunk, the botsv1_data_set app, and the apps/add-ons listed in the table above you can begin searching the data with the following Splunk Search Processing Languange (SPL):\n\n\tindex=botsv1 earliest=0\n\n### JSON - Complete\nDownload the JSON-formatted complete dataset from this location: [botsv1.json.gz](https://s3.amazonaws.com/botsdataset/botsv1/botsv1.json.gz) (11.3GB compressed, ~120GB uncompressed)\n\n\n### JSON - by Sourcetype\n| Splunk Sourcetype | Compressed JSON file |\n| ----------------- | -------------------- |\n| WinEventLog:Application | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.WinEventLog-Application.json.gz |\n| WinEventLog:Security | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.WinEventLog-Security.json.gz |\n| WinEventLog:System | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.WinEventLog-System.json.gz |\n| XmlWinEventLog:Microsoft-Windows-Sysmon/Operational | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.XmlWinEventLog-Microsoft-Windows-Sysmon-Operational.json.gz |\n| fgt_event | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.fgt_event.json.gz |\n| fgt_traffic | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.fgt_traffic.json.gz |\n| fgt_utm | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.fgt_utm.json.gz |\n| iis | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.iis.json.gz |\n| nessus:scan | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.nessus-scan.json.gz |\n| stream:dhcp | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-dhcp.json.gz |\n| stream:dns | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-dns.json.gz |\n| stream:http | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-http.json.gz |\n| stream:icmp | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-icmp.json.gz |\n| stream:ip | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-ip.json.gz |\n| stream:ldap | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-ldap.json.gz |\n| stream:mapi | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-mapi.json.gz |\n| stream:sip | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-sip.json.gz |\n| stream:smb | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-smb.json.gz |\n| stream:snmp | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-snmp.json.gz |\n| stream:tcp | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.stream-tcp.json.gz |\n| suricata | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.suricata.json.gz |\n| winregistry | https://s3.amazonaws.com/botsdataset/botsv1/json-by-sourcetype/botsv1.winregistry.json.gz |\n\n### CSV by Sourcetype\n| Splunk Sourcetype | Compressed CSV file |\n| ----------------- | ------------------- |\n| WinEventLog:Application | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.WinEventLog%3AApplication.csv.gz |\n| WinEventLog:Security | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.WinEventLog%3ASecurity.csv.gz |\n| WinEventLog:System | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.WinEventLog%3ASystem.csv.gz |\n| XmlWinEventLog:Microsoft-Windows-Sysmon/Operational | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.XmlWinEventLog%3AMicrosoft-Windows-Sysmon-Operational.csv.gz |\n| fgt_event | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.fgt_event.csv.gz |\n| fgt_traffic | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.fgt_traffic.csv.gz |\n| fgt_utm | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.fgt_utm.csv.gz |\n| iis | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.iis.csv.gz |\n| nessus:scan | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.nessus%3Ascan.csv.gz |\n| stream:dhcp | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Adhcp.csv.gz |\n| stream:dns | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Adns.csv.gz |\n| stream:http | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Ahttp.csv.gz |\n| stream:icmp | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Aicmp.csv.gz |\n| stream:ip | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Aip.csv.gz |\n| stream:ldap | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Aldap.csv.gz |\n| stream:mapi | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Amapi.csv.gz |\n| stream:sip | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Asip.csv.gz |\n| stream:smb | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Asmb.csv.gz |\n| stream:snmp | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Asnmp.csv.gz |\n| stream:tcp | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.stream%3Atcp.csv.gz |\n| suricata | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.suricata.csv.gz |\n| winregistry | https://s3.amazonaws.com/botsdataset/botsv1/csv-by-sourcetype/botsv1.winregistry.csv.gz |\n\n## Warning\n**Please be advised that this dataset may contain profanity, slang, vulgar expressions, and/or generally offensive terminology. Please use with discretion.** \n\nThis dataset contains evidence captured during actual computer security incidents, or from realistic lab recreations of security incidents. As such, the dataset **may** contain profanity, slang, vulgar expressions, and/or generally offensive terminology. The authors believe that the educational benefits of preserving the realism of the dataset outweigh the risk of offending some users. If the possibility of encountering this type of offensive material is a concern to you or to any audience with whom you plan to share the dataset, please stop now and do not continue.\n\n## Authors\nWritten in 2016 by Ryan Kovar, David Herrald, and James Brodsky\n\n## Copyright and License\nTo the extent possible under law, the author(s) have dedicated\nall copyright and related and neighboring rights to this software\nto the public domain worldwide. This software is distributed\nwithout any warranty. You should have received a copy of the CC0\nPublic Domain Dedication along with this software. If not, see\nhttp://creativecommons.org/publicdomain/zero/1.0/.\n","funding_links":[],"categories":["Threat Detection and Hunting","Other Lists","\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集"],"sub_categories":["Dataset","Training","📚 Training"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsplunk%2Fbotsv1","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsplunk%2Fbotsv1","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsplunk%2Fbotsv1/lists"}