SOC-RL: A Live-Range Dataset of Measured Defensive Transitions for Autonomous SOC Response

Modern Security Operations Centers (SOCs) increasingly need autonomous response: not only detecting intrusions but deciding, in real time, how to react. Progress on learned response policies is held back by the absence of public datasets that pair a detection state with a defensive action and a measured outcome. We present SOC-RL, a reinforcement-learning dataset of State→Action→Reward→Next-State transitions collected on a live, containerised cyber range that extends the multi-layer detection SOC of the SOC-MLD dataset [1]. The environment exposes a 12-dimensional state built from live NIDS (Suricata) and web-server telemetry, a deployable action space (monitor, honeypot-redirect, hard-block) executed for real through the SOC's control API, and a multi-objective reward balancing attack containment, service availability and false-positive avoidance. We release 7,322 transitions over 1,800 episodes gathered under a multi-vector attack campaign with concurrent legitimate traffic, across three deployment conditions (distinct addressing, shared NAT addressing, and source-IP rotation), with the behaviour policy's action propensities logged for off-policy learning. Beyond an offline Fitted-Q baseline, our central result is a comparison of off-policy value estimates (FQE) against on-policy returns measured on the live range, and a demonstration that the “block the source” heuristic — trivially optimal in the usual single-address setting — becomes the worst active choice under shared NAT addressing, where it attains full containment but drives benign availability to zero. We further benchmark conservative offline-RL algorithms (CQL, BCQ) against an offline-DQN baseline on the same estimator. SOC-RL thus isolates the gap between what offline estimation promises and what a deployed policy delivers, and the sensing/action-space requirements a real autonomous responder must meet.