botsv3 VS botsv1

I haven't had much time to work on a BoTSv3 (Boss of the SOC Version 3) guide yet, but the GitHub guide for it should do the trick. I prefer video guides, but the README on GitHub is decent. At a high-level, you will need to install Splunk, install the needed apps+add-on, and finally install the dataset. Here is the GitHub repo for the dataset: https://github.com/splunk/botsv3

Once you have splunk installed and running, you can start ingesting data from your environment, such as your firewall or other machines/services you're working with. There are lots of supported add-ons and guides online to help you with ingesting data. If you don't have data to ingest but still want to play around with performing investigations in Splunk, I would check out Boss of the SOC. It contains a large data set as well as necessary add-ons and apps for you to start playing around. Here is a link to the GitHub repo: https://github.com/splunk/botsv3

And if you really have nothing you can download a BOTS dataset https://github.com/splunk/botsv3

Also, bots (Boss of the SOC) Here is v3

Look through the BOTS datasets. See if you can configure threat hunting reports/dashboards on your SIEM platforms based off of SIGMA rules or Att&ck Technique hypothesis. Follow Florian Roth, samir bousseaden, the Rodriguez brothers and olaf hartong on Twitter, watch all their talks and go through their various github projects.

You can start with Boss of The SOC BOTS. There are 3 datasets and walkthroughs, you just need to install the free community version of Splunk on any hypervisor. The advantage is that it’s free.