Ryan Kovar's Blog Posts

From the basics, to new data, to registration information, discover all you need to know about Splunk BOTS 4.0 at .conf19.

A brief overview of wire data, its uses and sources, and the new Splunk Essentials for Wire Data app

This blog post describes how to use Azure Active directory for basic hunting and discovery

We have open-sourced the Boss of the SOC dataset (ver1.0) and BOT(S|N) scoring server. They can be used to run your own CTF, perform research, or train your internal users!

We introduced a new security activity at .conf2016 called “Boss of the SOC” (or BOTS), born from our belief that learning can be both realistic and fun.

Learn some methods for hunting and detecting PowerShells no matter the "methodology"