Australia & New Zealand Boss of the SOC Day 2020

The best things come in threes and for the third year in a row, Splunkers down-under will take to the (virtual) thunderdome to battle it out for supreme bragging rights and plenty of schwag in the (virtual) Australia & New Zealand Boss of the SOC (BOTS) Day held on August 20, 2020. 

What is Boss of the SOC?

BOTS is a blue-team, jeopardy-style, capture-the-flag-esque (CTF) activity where participants leverage all of Splunk’s Security Operations Suite — and other resources — to answer a variety of questions about real-world security incidents analysts face regularly in a simulated enterprise environment. We developed BOTS because we were tired of showing up at security conferences and finding the CTFs to be entirely red-team oriented. There are other blue team CTFs out there — especially the grandfather to them all, SANS NetWars — but few of them attempt to recreate the life of a security analyst facing down an adversary at all stages of an attack.

In BOTS, we work very hard to ask questions that not only require contestants to know and/or get to know Splunk solutions, but also know how to research open source intelligence and think outside of the "Splunk Security" box.

Are you excited yet?

What is the Australian & New Zealand BOTS Day?

Social distancing isn’t going to stop us from running a social event so this year, we’re going virtual and it will be bigger than ever before! With 10 cities across two countries, a year’s worth of bragging rights are up for grabs along with some awesome Splunk swag!

There will be no compromises, this event will feature everything you've come to love about BOTS. Participants will compete from their safe, secure, and socially distanced locations across Australia and New Zealand. But you won't be isolated during this virtual BOTS event, far from it! Just like always in BOTS, you are encouraged to compete in teams of up to four, and we are busy preparing a brand new never-before-seen enhanced virtual experience for this year's event.

We'll crown city champs in each location and an overall BOTS Day winner. 

Each team captain will register each team and its members for the day over at the registration page. Once registered, you’ll receive a welcome email with all the details required. Don’t have a team? That’s ok, we’ve got you covered and can put you in a team of like-minded peers!

Australian & New Zealand BOTS Day Schedule

Spoiler Alert?

BOTS Day will utilize the BOTSv4 dataset unveiled at .conf19 back in October. While the dataset will be the same, we are busy creating a brand new question set for BOTS day. The event will feature never-before-seen questions, no spoilers, and no unfair advantages for you or anyone else.

Should I Play?

In a word, yes. We've written about who should play before, but it's worth repeating here. If you've gotten this far, you are almost certainly an excellent fit for BOTS. To hold your own in BOTS, we usually tell folks they need to know a little about the Splunk security solutions and a little about security. However, all you need is the desire to learn and have fun.

Yes, indeed, the winners of BOTS competitions are often very knowledgeable in both Splunk solutions and security. Still, everyone will have a great time and learn something new.

The questions in BOTS range from easy to hard and everything in between. Every question comes with hints to nudge you in the right direction, and if you need more, coaches are virtually available to help when the hints run out. Also — don't forget — BOTS is a team sport, so if you bring your crew, you won't be alone.

If all of that isn't enough to convince you that BOTS is a safe, supportive, and fun learning environment, we've now made it super easy to play anonymously if you choose. Are you feeling a little judged on that big scoreboard? No problem. Just flip the bit on anonymous mode to take the pressure off while you catch up or plot your next move.

How Can I Prepare?

Here are some great ways to prepare for BOTS day:

• We’ve been running Virtual Workshops bi-weekly throughout the COVID season to help upskill to ninja levels, join in as we walk through a variety of scenarios with hands-on access to the Splunk Security Operations Suite and BOTS datasets.
• Check out our "Hunting With Splunk" blog series. More than anything else, mastering the topics covered in this series will help you answer more questions faster
• Take advantage of Free Splunk Fundamentals 1 Training
• Practice your Splunk hunting with prior versions of BOTS
• Stand up your very own BOTS environment and practice
  
   

Is There Any Fine Print?

Yeah, there's always a little, isn't there? Registration is required, but free; space is limited; no game-day registration allowed:

• Please register with an email that you can access on the day of the event
• Contestants are encouraged to register in teams of up to four for the best experience (teams with more than four members will not be allowed)
• IMPORTANT: Each team captain must register a team and nominate the members of their team. Each member will receive a confirmation of their registration and details can be changed at any time.
• You will need a laptop or personal computer with internet connectivity and running a supported web browser
• We will be kicking off in style over a Zoom Webinar and providing real-time support via Slack in the Splunk Usergroup Workspace. 
• You are welcome to use our Slack Workspace with group chat to collaborate in your team, or to level-up and increase your real-world experience, you are welcome to use your own collaboration tools as well.
• On BOTS Day, you will need to acknowledge Splunk's privacy statement before you are allowed to play
   

How Do I Register Again?

Just sign up, here. We look forward to hosting you at Splunk Australia & New Zealand BOTS Day 2020!

----------------------------------------------------
Thanks!
Nick Stone