◆ Attack logs

Splunk Attack Data

Apache-2.0

Curated attack telemetry generated with Atomic Red Team and replayable into Splunk, paired with Splunk Security Content detections.

source ↗ ★ 811 last push 2026-09-07

Summary

From the project’s own instructions where it documents any; otherwise a plain clone.

shell
```
$ git lfs install --skip-smudge
```
The data lives in Git LFS. --skip-smudge stops the clone from downloading every dataset.

shell

$ git clone https://github.com/splunk/attack_data

shell

$ cd attack_data && git lfs pull --include=datasets/attack_techniques/T1003.001/atomic_red_team/

Pull only the technique you need (T1003.001 shown), or `git lfs pull` for everything.

3,720 files 69.0 MB repository

Commands are curated, not yet run by us.

jq — Stream the records one per line to see their shape before loading them anywhere.

sample.json

$ jq -c . sample.json

DuckDB — Query the file in place with SQL — DuckDB detects CSV and JSON by extension.

sample.json

$ duckdb -c 'SELECT * FROM '\''sample.json'\'' LIMIT 10'