[Dataset] Synthetic SOC Log Analysis Datasets with Hidden Attack Vectors for SIEM & Threat Hunting Practice
4 days ago by peter to c/blueteamsec
Hey everyone,
Finding realistic logs for detection engineering and threat hunting practice is tough—clean logs have no attacks, and real breach dumps are messy or risky to touch.
I put together an open-source collection of 100% synthetic, SIEM-agnostic logs across 5 domains (Applications, Cloud, Email/DLP, Endpoints, and Network). Every file blends realistic background noise with hidden simulated attack vectors:
• Web/App: SQLi, XSS, directory traversal • Cloud: IAM privilege escalation, unauthorized access, audit tampering • Network: DNS tunneling, C2 beaconing, port scans, VPN anomalies • Endpoints: Windows EventID 4625 brute force, Linux privilege escalation • Email & DLP: Phishing payloads and data exfiltration
Works out of the box with Splunk, Elastic (ELK), Sentinel, Wazuh, or CLI tools (grep/awk/jq). The README includes a starter Threat Hunting Playbook with sample queries.
Totally free and MIT licensed. Hope this helps anyone building homelabs or practicing detection! Feedback and PRs are welcome.
@infosec.pub
For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.
go to feed...
@infosec.pub
For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.
go to feed...
Done.
save