Precinct6: Large-Scale SOC Security Events and Incident Graphs

WitFoo provides a labeled cybersecurity dataset containing 114,234,041 sanitized security events and 12,361 incident provenance graphs. The data is derived from production Security Operations Center (SOC) logs processed by WitFoo Precinct version 6.x. It was last updated on May 13, 2026.

Use Cases

• Train anomaly detection models based on the large volume of sanitized security event signals.
• Analyze incident provenance and attack patterns using the provided graph structures with nodes and edges.
• Benchmark cybersecurity AI systems on data derived from real-world, multi-organizational SOC environments.

Strengths

• Contains 114,234,041 labeled security events, providing a substantial volume of data.
• Includes 12,361 incident provenance graphs with 47,632 nodes and 32,086,552 edges for structured analysis.
• Derived from production SOC data across 5 organizations, suggesting real-world relevance.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• Row count for the specific '100M' version is unknown, which may limit suitability assessment.
• Data may reflect temporal or organizational bias inherent to the specific SOC sources.

Provenance

Source

WitFoo Precinct version 6.x production Security Operations Center (SOC) data.

Collection Method

Derived and sanitized from production security event logs.

Freshness

Last updated 2026-05-13 14:59:20; freshness should be verified.