---
title: 'Boss of The SOC'
url: 'https://www.ondrejsramek.cz/en/blog/bots'
markdown: 'https://www.ondrejsramek.cz/en/blog/bots.md'
lang: en
date: '2018-11-09'
description: 'BOTS vs. NetWars Both are essentially the same type of competition. You have a time limit to collect as many flags (points) as possible, which pushes you up the leaderboard. With SANS (NetWars) there are different scenarios — forensics (DFIR NetWars) or Pen Test. Personally I prefer the second; the…'
taxonomy:
  category:
    - 'informační technologie'
  tag:
    - školení
    - Splunk
    - BOTS
  '':
    - ''
  archives_year:
    - '2018'
---

# BOTS vs. NetWars

Both are essentially the same type of competition. You have a time limit to collect as many **flags** (points) as possible, which pushes you up the leaderboard. With **SANS** (NetWars) there are different scenarios — forensics (**DFIR** NetWars) or **Pen Test**. Personally I prefer the second; the first is quite demanding if you don't have solid Windows knowledge (**FOR508**). That said, a good cheat sheet helps a lot. It's two hours total and a very intense experience — made even more so by the mix of people who do this every day and people seeing it for the very first time.

BOTS gave me a similar feeling. The difference is it's partly a pitch for Enterprise Security and User Behavior Analysis. That said, even for beginners with a security background it's very good practice. The scenario is very complex — there's a huge amount of data and it's hard to make sense of it quickly. But without **Splunk's** magic it would be nearly impossible to manage. On one hand Splunk does a lot of pre-calculation for you; on the other, you need to know where to find things in the tool. And that, to me, is the biggest weakness. Click in the right place and the answer just **falls out**. No crafting complex SPL queries and refining them. Both approaches have their merits. But I feel like it oversimplifies the work to the point where it doesn't teach analysts to think. Splunk does all the thinking. And I don't think that's good. We're not yet at a point where we should hand detection **solely** to a tool.

I'll definitely want to keep taking part in both of these events — they give you real-world experience. And that's **priceless**!

 [ Previous Post](https://www.ondrejsramek.cz/en/blog/zmatky-na-poste) [Next Post ](https://www.ondrejsramek.cz/en/blog/zaslepenost) 

#### Other Related Posts:

 [  sw  ](https://www.ondrejsramek.cz/en/blog/tag:sw#blog_list) [  bezpečnost  ](https://www.ondrejsramek.cz/en/blog/tag:bezpe%C4%8Dnost#blog_list) [  školení  ](https://www.ondrejsramek.cz/en/blog/tag:%C5%A1kolen%C3%AD#blog_list) [  konference  ](https://www.ondrejsramek.cz/en/blog/tag:konference#blog_list) [  Splunk  ](https://www.ondrejsramek.cz/en/blog/tag:Splunk#blog_list) [  Orlando  ](https://www.ondrejsramek.cz/en/blog/tag:Orlando#blog_list) 

###  .conf18 

[.conf18](https://www.ondrejsramek.cz/en/blog/conf18)

# Conference and training from the perspective of a new Splunk user

I had the chance to attend the **Power User Bootcamp** training at the Splunk .conf18 conference in Orlando. It was a real experience — both in terms of how such a massive event was organised, the breadth of topics covered, and the op...

 5th Oct 2018 

 [ ![Elastic Courses](https://www.ondrejsramek.cz/user/pages/05.blog/42.kurzy-od-elastic/Screenshot%202020-07-04%20at%2022.52.26.png) ](https://www.ondrejsramek.cz/en/blog/kurzy-od-elastic) [  ELK  ](https://www.ondrejsramek.cz/en/blog/tag:ELK#blog_list) [  Kibana  ](https://www.ondrejsramek.cz/en/blog/tag:Kibana#blog_list) [  elastic  ](https://www.ondrejsramek.cz/en/blog/tag:elastic#blog_list) [  ML  ](https://www.ondrejsramek.cz/en/blog/tag:ML#blog_list) [  Endgame  ](https://www.ondrejsramek.cz/en/blog/tag:Endgame#blog_list) 

###  Elastic Courses 

[Elastic Courses](https://www.ondrejsramek.cz/en/blog/kurzy-od-elastic)

# Elasticsearch, Logstash, Kibana — and Filebeat and Endgame too

**Elastic** offers a lot of training, some of it free. A while back I completed [Fundamentals of Securing Elasticsearch](https://www.elastic.co/training/fundamentals-of-securing-elasticsearch), a useful course on securing communication between Elasticsearch hosts. I was curious how far Kibana had come and wha...

 5th Jul 2020 

- [Intro](https://www.ondrejsramek.cz/en)
- [Projects](https://www.ondrejsramek.cz/en/projects)
- [Portfolio](https://www.ondrejsramek.cz/en/portfolio)
- [Pricing](https://www.ondrejsramek.cz/en/pricing)
- [Blog](https://www.ondrejsramek.cz/en/blog)
- English 

    - [Čeština](https://www.ondrejsramek.cz/cs/blog/bots)

---

## Navigation

- Parent: [Blog](https://www.ondrejsramek.cz/en/blog.md)
- Previous: [Blindness?](https://www.ondrejsramek.cz/en/blog/zaslepenost.md)
- Next: [Post Office Confusion](https://www.ondrejsramek.cz/en/blog/zmatky-na-poste.md)