Dataset

witfoo/precinct6-cybersecurity

Text classification, Graph ml1M<n<10M rowsLicense: apache-2.0

attack_reports · train graph_edges · train graph_nodes · train incident_signals · train signals · train

First 50 rows of train

timestampfloat64	event_timefloat64	timestamp_sourcestring	originstring	org_idstring	artifact_idstring	message_typestring	stream_namestring	pipelinestring	src_ipstring	dst_ipstring	src_portstring	dst_portstring	protocolstring	src_hoststring	dst_hoststring

1721992230.4798615

artifact.timeuuid

live

ORG-0001

ab8acf98-4b3f-11ef-9f23-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:45:01 HOST-0001 CROND[1933212]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

none

Unprocessed

automated

false

[]

1721992226.4762523

artifact.timeuuid

live

ORG-0001

a927e89b-4b3f-11ef-8e29-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:10:01 HOST-0001 CROND[1755970]: (root) CMD (/usr/lib64/sa/sa1 1 1)

benign

0.5

[]

1721992266.6498992

artifact.timeuuid

live

ORG-0001

c119ebb0-4b3f-11ef-80b2-02c153059a64

unknown

no_useful_info

syslog

host-0001.example.internal

[2023-12-17T13:04:26.495Z] [ message] [vix] VixTools_ProcessVixCommand: command 186

benign

0.5

[]

1721992323.6843653

artifact.timeuuid

live

ORG-0001

e318b083-4b3f-11ef-bf94-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:20:01 HOST-0001 CROND[1778559]: (root) CMD (/usr/lib64/sa/sa1 1 1)

benign

0.5

[]

1721992233.0530589

artifact.timeuuid

live

ORG-0001

ad13731b-4b3f-11ef-99c3-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Dec 30 20:00:01 HOST-0001 CROND[3404690]: (root) CMD (/usr/lib64/sa/sa1 1 1)

benign

0.5

[]

1721992227.7333848

artifact.timeuuid

live

ORG-0001

a9e7bb58-4b3f-11ef-aa23-02c153059a64

diagnostic_event

filebeat_diagnostic

syslog

host-0001.example.internal

error

Jan 7 03:45:44 HOST-0001 filebeat: 2024-01-07T03:45:44.550-0600#011ERROR#011[logstash]#011logstash/async.go:280#011Failed to publish events caused by: read tcp 10.213.193.198:49020->10.73.183.87:5044: read: connection reset by peer

benign

0.5

[]

1721992223.729255

artifact.timeuuid

live

ORG-0001

a784c006-4b3f-11ef-9942-02c153059a64

auth_event

systemd_logind

syslog

host-0001.example.internal

notice

Jan 14 03:31:36 HOST-0001 systemd-logind: Removed session 8072854.

benign

0.5

[]

1721992308.5044608

artifact.timeuuid

live

ORG-0001

da0c6b80-4b3f-11ef-aacc-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:01:01 HOST-0001 CROND[1737194]: (root) CMD (run-parts /etc/cron.hourly)

benign

0.5

[]

1721992296.04237

artifact.timeuuid

live

ORG-0001

d29edb13-4b3f-11ef-92a6-02c153059a64

auth_event

systemd_logind

syslog

host-0001.example.internal

notice

Jan 14 03:31:39 HOST-0001 systemd-logind: Removed session 8072895.

benign

0.5

[]

1721992281.7117524

artifact.timeuuid

live

ORG-0001

ca142d55-4b3f-11ef-83e1-02c153059a64

diagnostic_event

filebeat_diagnostic

syslog

host-0001.example.internal

informational

Dec 24 03:24:24 HOST-0001 filebeat: 2023-12-24T03:24:24.701-0600#011INFO#011[publisher]#011pipeline/retry.go:223#011 done

benign

0.5

[]

1721992275.385904

artifact.timeuuid

live

ORG-0001

c64eede0-4b3f-11ef-8d4c-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:25:01 HOST-0001 CROND[1788471]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992313.1731942

artifact.timeuuid

live

ORG-0001

dcd4cfe6-4b3f-11ef-8d34-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:01:01 HOST-0001 CROND[1737194]: (root) CMD (run-parts /etc/cron.hourly)

benign

0.5

[]

1721992314.3104708

artifact.timeuuid

live

ORG-0001

dd8258c4-4b3f-11ef-aa0d-02c153059a64

management_message

cisco_os

syslog

10.153.109.216

error

<187>296635: HOST-0232: Jul 26 06:11:43.561 CDT: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/19, changed state to down

benign

0.5

[]

1721992372.976372

artifact.timeuuid

live

ORG-0001

007a0d87-4b40-11ef-bccd-02c153059a64

auth_event

systemd_logind

syslog

host-0001.example.internal

notice

Jan 21 03:36:50 HOST-0001 systemd-logind: Removed session 8940192.

benign

0.5

[]

1721992363.7487617

artifact.timeuuid

live

ORG-0001

fafa07ff-4b3f-11ef-a8d4-02c153059a64

management_message

cisco_os

syslog

10.221.185.111

notice

<189>576617: HOST-0233: Jul 26 06:12:33.610 CDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet6/0/30, changed state to down

benign

0.5

[]

1721992361.7471025

artifact.timeuuid

live

ORG-0001

f9c89a31-4b3f-11ef-b80d-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:20:01 HOST-0001 CROND[1778559]: (root) CMD (/usr/lib64/sa/sa1 1 1)

benign

0.5

[]

1721992396.1903307

artifact.timeuuid

live

ORG-0001

0e5038cc-4b40-11ef-b101-02c153059a64

management_message

cisco_os

syslog

10.153.109.216

error

<187>296668: HOST-0232: Jul 26 06:13:04.134 CDT: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/19, changed state to up

benign

0.5

[]

1721992433.24232

artifact.timeuuid

live

ORG-0001

2465e821-4b40-11ef-8c25-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:50:01 HOST-0001 CROND[1961007]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992407.268152

artifact.timeuuid

live

ORG-0001

14ea9030-4b40-11ef-bb25-02c153059a64

auth_success

sshd

syslog

10.143.60.26

61104

host-0001.example.internal

USER-0001

notice

Jan 21 03:31:11 HOST-0001 sshd[1770364]: Accepted password for USER-0001 from 10.143.60.26 port 61104 ssh2

benign

0.5

[]

1721992402.5990932

artifact.timeuuid

live

ORG-0001

12221f13-4b40-11ef-9d15-02c153059a64

auth_success

sshd

syslog

10.143.60.26

61104

host-0001.example.internal

USER-0001

notice

Jan 21 03:31:11 HOST-0001 sshd[1770364]: Accepted password for USER-0001 from 10.143.60.26 port 61104 ssh2

benign

0.5

[]

1721992435.926707

artifact.timeuuid

live

ORG-0001

25ff82fe-4b40-11ef-94fe-02c153059a64

diagnostic_event

filebeat_diagnostic

syslog

host-0001.example.internal

informational

Dec 24 03:24:24 HOST-0001 filebeat: 2023-12-24T03:24:24.701-0600#011INFO#011[publisher]#011pipeline/retry.go:223#011 done

benign

0.5

[]

1721992475.0125256

artifact.timeuuid

live

ORG-0001

3d4b88c8-4b40-11ef-b7f9-02c153059a64

auth_success

sshd

syslog

10.143.60.26

59962

host-0001.example.internal

USER-0001

notice

Dec 31 03:24:44 HOST-0001 sshd[557198]: Accepted password for USER-0001 from 10.143.60.26 port 59962 ssh2

benign

0.5

[]

1721992488.7961996

artifact.timeuuid

live

ORG-0001

4582c18c-4b40-11ef-87d1-02c153059a64

communication

network_communication

network_flows

10.173.156.178

10.143.4.184

135

10.73.183.87

benign

0.5

[]

1721992456.0917099

artifact.timeuuid

live

ORG-0001

3204726a-4b40-11ef-baef-02c153059a64

systemd_event

systemd

syslog

host-0001.example.internal

notice

Jan 14 03:31:35 HOST-0001 systemd: Started Session 8072900 of user USER-0001.

benign

0.5

[]

1721992451.0857823

artifact.timeuuid

live

ORG-0001

2f089a61-4b40-11ef-bf91-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:25:01 HOST-0001 CROND[1788471]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992498.774792

artifact.timeuuid

live

ORG-0001

4b755e50-4b40-11ef-a5cf-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:40:01 HOST-0001 CROND[1887638]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992476.7209735

artifact.timeuuid

live

ORG-0001

3e503908-4b40-11ef-84ed-02c153059a64

auth_success

sshd

syslog

10.143.60.26

59962

host-0001.example.internal

USER-0001

notice

Dec 31 03:24:44 HOST-0001 sshd[557198]: Accepted password for USER-0001 from 10.143.60.26 port 59962 ssh2

benign

0.5

[]

1721992513.756328

artifact.timeuuid

live

ORG-0001

54635e90-4b40-11ef-b657-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:40:01 HOST-0001 CROND[1887644]: (root) CMD (/usr/lib64/sa/sa1 1 1)

benign

0.5

[]

1721992469.1343093

artifact.timeuuid

live

ORG-0001

39ca96f3-4b40-11ef-a3f5-02c153059a64

management_message

cisco_os

syslog

10.25.241.232

notice

<189>21624: 10.25.241.232: Jul 26 06:14:16.508 CDT: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: USER-20649] [Source: 10.47.145.131] [localport: 22] at 06:14:16 CDT Fri Jul 26 2024

benign

0.5

[]

1721992455.1859934

artifact.timeuuid

live

ORG-0001

317a3ede-4b40-11ef-b3ec-02c153059a64

auth_success

sshd

syslog

10.143.60.26

61104

host-0001.example.internal

USER-0001

notice

Jan 21 03:31:11 HOST-0001 sshd[1770364]: Accepted password for USER-0001 from 10.143.60.26 port 61104 ssh2

benign

0.5

[]

1721992451.1789975

artifact.timeuuid

live

ORG-0001

2f16d398-4b40-11ef-804f-02c153059a64

auth_failure

generic_log

syslog

10.33.86.71

informational

<142>Jul 26 11:14:02 local1: Host: HOST-0006 Duration: 6837:01:53 Count: 903297; INFORMATIONAL: Authentication failure.

suspicious

0.7000000000000001

["T1190"]

["TA0001", "TA0002"]

1721992490.4108555

artifact.timeuuid

live

ORG-0001

4679220c-4b40-11ef-b8af-02c153059a64

communication

network_communication

network_flows

192.0.2.10

192.0.2.223

4500

10.73.183.87

benign

0.5

[]

1721992483.1067123

artifact.timeuuid

live

ORG-0001

421e9bf3-4b40-11ef-b2a1-02c153059a64

communication

network_communication

network_flows

10.31.239.188

192.0.2.232

10.73.183.87

benign

0.5

[]

1721992540.561056

artifact.timeuuid

live

ORG-0001

645d723e-4b40-11ef-95a1-02c153059a64

auth_success

sshd

syslog

10.143.60.26

61104

host-0001.example.internal

USER-0001

notice

Jan 21 03:31:11 HOST-0001 sshd[1770364]: Accepted password for USER-0001 from 10.143.60.26 port 61104 ssh2

benign

0.5

[]

1721992529.1295202

artifact.timeuuid

live

ORG-0001

5d8d21e2-4b40-11ef-a6c5-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:53:01 HOST-0001 CROND[1978565]: (root) CMD (/usr/lib64/sa/sa2 -A)

benign

0.5

[]

1721992563.3109646

artifact.timeuuid

live

ORG-0001

71ecce8e-4b40-11ef-a925-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:53:01 HOST-0001 CROND[1978565]: (root) CMD (/usr/lib64/sa/sa2 -A)

benign

0.5

[]

1721992570.860041

artifact.timeuuid

live

ORG-0001

766cb45a-4b40-11ef-b2a3-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:55:01 HOST-0001 CROND[1997207]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992566.1686602

artifact.timeuuid

live

ORG-0001

73a0db4a-4b40-11ef-af77-02c153059a64

diagnostic_event

filebeat_diagnostic

syslog

host-0001.example.internal

informational

Jan 7 03:45:44 HOST-0001 filebeat: 2024-01-07T03:45:44.573-0600#011INFO#011[publisher]#011pipeline/retry.go:219#011retryer: send unwait signal to consumer

benign

0.5

[]

1721992626.124952

artifact.timeuuid

live

ORG-0001

975d75f1-4b40-11ef-b9d2-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:20:01 HOST-0001 CROND[1778559]: (root) CMD (/usr/lib64/sa/sa1 1 1)

benign

0.5

[]

1721992631.2607088

artifact.timeuuid

live

ORG-0001

9a6d1d70-4b40-11ef-9638-02c153059a64

auth_event

systemd_logind

syslog

host-0001.example.internal

notice

Jan 21 03:36:50 HOST-0001 systemd-logind: Removed session 8940192.

benign

0.5

[]

1721992667.0274663

artifact.timeuuid

live

ORG-0001

afbeb068-4b40-11ef-ba95-02c153059a64

auth_event

systemd_logind

syslog

host-0001.example.internal

notice

Jan 21 03:36:50 HOST-0001 systemd-logind: Removed session 8940192.

benign

0.5

[]

1721992639.7365742

artifact.timeuuid

live

ORG-0001

9f7a6dee-4b40-11ef-8a3a-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:20:01 HOST-0001 CROND[1778558]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992648.3405938

artifact.timeuuid

live

ORG-0001

a49b4c72-4b40-11ef-aac2-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:20:01 HOST-0001 CROND[1778559]: (root) CMD (/usr/lib64/sa/sa1 1 1)

benign

0.5

[]

1721992642.3332736

artifact.timeuuid

live

ORG-0001

a106a781-4b40-11ef-a269-02c153059a64

pam_event

pam

syslog

host-0001.example.internal

notice

Dec 24 03:28:10 HOST-0001 sshd[1461858]: pam_unix(sshd:session): session opened for user USER-0001 by (uid=0)

benign

0.5

[]

1721992655.0171149

artifact.timeuuid

live

ORG-0001

a8960e0b-4b40-11ef-87ae-02c153059a64

diagnostic_event

filebeat_diagnostic

syslog

host-0001.example.internal

error

benign

0.5

[]

1721992738.6757627

artifact.timeuuid

live

ORG-0001

da7359fa-4b40-11ef-9456-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 6 12:15:01 HOST-0001 CROND[1767609]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992730.8835008

artifact.timeuuid

live

ORG-0001

d5ce58c1-4b40-11ef-843f-02c153059a64

systemd_event

crond

syslog

host-0001.example.internal

notice

Jan 19 23:40:01 HOST-0001 CROND[1887638]: (USER-0001) CMD (if [ -f /epic/redalert/bin/ra_sched ]; then /epic/redalert/bin/ra_sched --monitor_scheduler > /dev/null 2>&1 ; fi)

benign

0.5

[]

1721992722.5147114

artifact.timeuuid

live

ORG-0001

d0d15eea-4b40-11ef-af3c-02c153059a64

diagnostic_event

filebeat_diagnostic

syslog

host-0001.example.internal

informational

Jan 7 03:45:44 HOST-0001 filebeat: 2024-01-07T03:45:44.550-0600#011INFO#011[publisher]#011pipeline/retry.go:223#011 done

benign

0.5

[]

1721992723.8341188

artifact.timeuuid

live

ORG-0001

d19ab244-4b40-11ef-b27e-02c153059a64

management_message

symantec_sep

syslog

10.114.15.107

error

<3>Jul 26 06:07:56 HOST-0007 SymantecServer: HOST-0260,Local Host IP: 224.0.0.252,Local Port: 2,Local Host MAC: 01005E0000FC,Remote Host IP: 10.230.9.186,Remote Host Name: ,Remote Port: 0,Remote Host MAC: 002B6716BF50,IP,Inbound,Begin: 2024-07-26 05:51:09,End Time: 2024-07-26 05:…

benign

0.5

[]

1721992695.707255

artifact.timeuuid

live

ORG-0001

c0d6e0a4-4b40-11ef-bd38-02c153059a64

unknown

no_useful_info

syslog

host-0001.example.internal

[2023-12-17T13:04:26.495Z] [ message] [vix] VixTools_ProcessVixCommand: command 186

benign

0.5

[]