Dataset: Behavior of Participants in Hands-on Cybersecurity Training Suitable for Process Mining

The dataset stores event logs of 52 trainees participating in a hands-on cybersecurity exercise organized in the KYPO Cyber Range. The data includes a training scenario (expected behavior), raw event logs in the JSON format, and aggregated behavioral data suitable for process mining analysis. Content Data. The data file is structured as follows: training_definition.json: The exercise content – cybersecurity tasks and hints. The training is based on the Locust 3302 game adapted to an insider attack scenario. training_events: Recorded progress of trainees within the exercise, i.e., the status of completing tasks. sandbox_events: Recorded commands executed on network hosts. process_mining.csv: Complete PM-ready dataset suitable for process discovery or conformance analysis. process_mining_simplified.csv : Reduced PM-ready dataset with semantically identical events being removed. Tool: A Java application used to aggregate raw JSON data and transform them into a CSV format suitable for process mining techniques.