bots-v3

Splunk SIEM investigation lab with SPL detection rules, BOTS dataset analysis, and IR reports mapped to MITRE ATT&CK

SOC investigation into external web reconnaissance and username enumeration attack against a vBulletin forum server using Splunk BOTS v3.

SOC investigation into anomalous internal host behaviour using Splunk BOTS v3 — cross-sourcetype analysis across HTTP, DNS, and Windows endpoint logs leading to a false positive determination.