◆ Attack logs

Security Datasets (Mordor)

MIT

Pre-recorded security event datasets from simulated adversary techniques, packaged as JSON for replay into a SIEM.

source ↗ ★ 1,810 last push 2024-03-20

Summary

The Security Datasets project is an open-source initiatve that contributes malicious and benign datasets, from different platforms, to the infosec community to expedite data analysis and threat research.

from the project README

Formats: jsonevtx
License: MIT
Added: 2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

shell

$ git clone --depth 1 https://github.com/OTRF/Security-Datasets

Shallow clone: history isn’t needed for testing.

733 files 810.5 MB repository

.zip 210
.ipynb 141
.yaml 114
.log 101
.rc 44
.md 39
.png 29
.gz 9

Use it with

Commands are curated, not yet run by us.

chainsaw — Run your Sigma rules over every event log in the dataset.

sample.evtx

$ chainsaw hunt ./Security-Datasets -s rules/ --mapping mappings/sigma-event-logs-all.yml

Hayabusa — Build a CSV timeline of detections across every .evtx file in the directory.

sample.evtx

$ hayabusa csv-timeline -d ./Security-Datasets -o timeline.csv

jq — Stream the records one per line to see their shape before loading them anywhere.

sample.json

$ jq -c . sample.json

DuckDB — Query the file in place with SQL — DuckDB detects CSV and JSON by extension.

sample.json

$ duckdb -c 'SELECT * FROM '\''sample.json'\'' LIMIT 10'

Security Datasets (Mordor)

Summary

Get it

Contents

Use it with

Related tools

WithSecure chainsaw

Yamato Security Hayabusa