Datasets¶
| Dataset | Used for | Size | Licence / terms |
|---|---|---|---|
SigmaHQ/sigma @ 07ec293 |
3,757 rules; regression_data (463 captures); known-FPs.csv |
13 MB | DRL 1.1 |
| NextronSystems/evtx-baseline v0.8.5 | Benign Windows corpus (3 hosts) | 270 MB, 3.1 GB extracted | public research data |
OTRF Security-Datasets @ d9d40ef |
98 Windows atomic emulations, APT29 days 1-2 | 123 MB | MIT |
| MITRE ATT&CK v19.2 STIX | Technique catalog | 54 MB | ATT&CK Terms of Use |
Splunk attack_data (opt-in nixcloud) |
Linux auditd, Sysmon for Linux and CloudTrail captures, labelled by technique folder | ~0.78 GB | Apache-2.0 |
OTRF Linux / AWS / Log4Shell captures (opt-in nixcloud) |
Linux and cloud emulations | small | MIT |
all downloads about 0.46 GB and needs about 4 GB of free disk after extraction and ingest. nixcloud is opt-in and runs in CI. Every download is pinned and SHA-256-verified, failing closed (scripts/checksums.sha256), and nothing is committed. Endpoint AV on the development laptop quarantines two OTRF archives and two regression captures. They are skipped locally and computed in the CI benchmark run, which asserts that every input was readable.