AD-GEN: LLM-Ready SOC Narratives from Windows Endpoint Telemetry

AD-GEN provides SOC narratives derived from large-scale Windows endpoint telemetry, designed for LLM reasoning. The dataset was created by author namhop88 and was last updated on June 4, 2026. It is described as containing evidence-preserving, validated narratives aligned with the ATT&CK framework.

Use Cases

• Fine-tuning LLMs for security operation center (SOC) report generation based on the described ATT&CK-aligned narratives.
• Training models to reason about fragmented endpoint telemetry events mentioned in the description.
• Developing tools for automated threat intelligence summarization based on the evidence-preserving narrative structure.

Strengths

• Derived from large-scale Windows endpoint telemetry, suggesting a substantial underlying data source.
• Narratives are validated and aligned with the ATT&CK framework, indicating structured labeling.

Limitations

• Description metadata is limited; actual data quality requires manual inspection after download.
• Column-level documentation is absent; field semantics must be inferred after download.
• Row count is unknown, which may limit suitability assessment.

Provenance

Source

namhop88

Collection Method

Derived from Windows endpoint telemetry, likely Sysmon logs.

Freshness

Last updated 2026-06-04 08:54:38; freshness should be verified.