This repository documents a defensive security (Blue Team) investigation carried out entirely against the Splunk Boss of the SOC (BOTS) v1 dataset — a training dataset that Splunk has published publicly for education and skill development.
It exists to demonstrate SOC analysis, threat hunting, and incident-response methodology. It contains no offensive tooling, exploit code, or malware samples.
- All IP addresses, hostnames, domains, file hashes, URLs, and credentials referenced in this repository are part of the publicly released BOTS v1 dataset.
- They describe a simulated attack within an isolated lab environment (the fictional "Wayne Enterprises" /
imreallynotbatman.comscenario). They are not live infrastructure and are safe to document. - The indicators of compromise (IOCs) are reproduced for educational completeness. Do not treat them as an active blocklist for production environments without independent validation.
The BOTS v1 dataset is the property of Splunk Inc. and is distributed under its own license:
This repository does not redistribute the dataset. Users must obtain it directly from Splunk.
The techniques described here are intended for:
- Defensive security training and SOC skill development
- Understanding attacker tradecraft to build better detections
- Authorized security testing and Capture-the-Flag (CTF) style learning
Do not use any technique or indicator from this repository to access systems you do not own or do not have explicit written authorization to test. The author assumes no liability for misuse.