Orgforge Insider Threat: Structured Security Telemetry from a 51-Day Corporate Simulation

A 51-day corporate simulation dataset produced by OrgForge with the insider threat module enabled. The corpus provides structured security telemetry in JSONL/Parquet format for benchmarking LLM-based detection, with ground truth derived deterministically from the simulation's event log. It was authored by aeriesec and last updated on 2026-03 25.

Use Cases

• Benchmarking LLM-based insider threat detection models based on structured security telemetry.
• Evaluating anomaly detection algorithms based on simulated corporate event logs.
• Training classifiers for threat identification based on deterministically derived ground truth labels.
• Researching patterns of insider threat behavior based on data from an event-driven organization simulator.

Strengths

• Data is pre-structured in JSONL/Parquet format, requiring no embedder.
• Ground truth labels are derived deterministically from the simulation's event log.
• Simulation runs for a defined 51-day period, providing temporal structure.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• Row count, file formats, and license are unknown, which may limit suitability assessment.
• Data is simulated, which may not fully reflect real-world threat patterns or noise.

Provenance

Source

OrgForge (event-driven organisation simulator) via Hugging Face user aeriesec.

Collection Method

Produced by running a corporate simulation with the insider threat module enabled.

Time Range

Covers a 51-day simulation period.

Freshness

Last updated 2026-03-25 03:30:33; freshness should be verified.

Geography

null