witfoo/precinct6-cybersecurity-100m

WitFoo Precinct6网络安全数据集(大型)是一个大规模、带有标签的网络安全数据集，源自WitFoo Precinct 6.x处理的生产安全运营中心(SOC)数据。数据集包含114,234,041个经过清理的安全事件(信号日志)，涵盖5个组织和12,361个事件溯源图(47,632个节点，32,086,552条边)。数据集支持溯源图入侵检测、AI驱动的网络防御模拟、安全警报分类、MITRE ATT&CK攻击生命周期分析和检测规则评估等研究。数据采用三层标签方法：恶意(74,064个事件，来自确认事件)、可疑(616,605个事件，匹配检测规则但未确认)和良性(113,543,372个事件，不匹配任何规则)。数据集包含丰富的信号列(如时间戳、IP地址、协议、MITRE ATT&CK技术映射等)、图数据组件和自然语言攻击报告。所有数据经过四层清理流程去除PII信息，确保隐私安全。数据集适用于网络安全研究，特别是入侵检测、威胁检测和安全操作自动化等领域。

The WitFoo Precinct6 Cybersecurity Dataset (large) is a large-scale, labeled cybersecurity dataset derived from production Security Operations Center (SOC) data processed by WitFoo Precinct version 6.x. The dataset contains 114,234,041 sanitized security events (signal logs) across 5 organizations and 12,361 incident provenance graphs (47,632 nodes, 32,086,552 edges). It is designed to support research in provenance graph-based intrusion detection, AI-driven cyber defense simulation, security alert classification, attack lifecycle analysis using MITRE ATT&CK framework mappings, and detection rule evaluation. The dataset uses a three-tier labeling methodology: malicious (74,064 events embedded in confirmed incidents), suspicious (616,605 events matching detection rules but not in incidents), and benign (113,543,372 events not matching any rules). It includes comprehensive signal columns (timestamp, IP addresses, protocols, MITRE ATT&CK mappings, etc.), graph data components, and natural-language attack reports. All data undergoes a four-layer sanitization pipeline to remove PII. The dataset is suitable for cybersecurity research, particularly in intrusion detection, threat detection, and security operations automation.