A large-scale, labeled cybersecurity dataset derived from production Security Operations Center (SOC) data processed by WitFoo Precinct version 6.x. It contains 2,011,674 sanitized security events captured live from 4 organizations (2024-07-26 11:10:23 UTC to 2024-08-01 06:00:03 UTC), 51,371 incident provenance graphs with their 238,511 embedded triggering signals, per-incident GraphML files, natural-language attack reports, and a merged provenance graph (47,585 nodes, 1,740,438 edges).

https://huggingface.co/datasets/witfoo/precinct6-cybersecurity/blob/main/README.md