lanl-cyber-datasets

LANL Cyber Datasets (2015 + 2017)

Raw, byte-identical copies of two Los Alamos National Laboratory public cybersecurity datasets, acquired exclusively from the official LANL source (https://csr.lanl.gov/). No mirrors, Kaggle copies, or repackaged distributions were used.

Contents

lanl-2015/
  redteam.txt.gz   known red-team compromise events (ground truth)
  auth.txt.gz      authentication events
  proc.txt.gz      process start/stop events
  flows.txt.gz     network flow events
  dns.txt.gz       DNS lookup events
  redteam.txt      decompressed copies of the above, stored alongside
  auth.txt         the archives (same path minus .gz/.bz2), for direct
  ...              use without a decompression step
lanl-2017/wls/
  wls_day-01.bz2 … wls_day-30.bz2      Windows host event logs (JSON lines)
  wls_day-01 … wls_day-30              decompressed copies (same path minus .bz2)
lanl-2017/netflow/
  netflow_day-02.bz2 … netflow_day-30.bz2   network flows (CSV)
  netflow_day-02 … netflow_day-30           decompressed copies (same path minus .bz2)

Notes:

• Filenames are preserved exactly as distributed by LANL. Each archive is stored twice: the original compressed file (byte-identical, never re-encoded) and its decompressed form at the same path minus the .gz/.bz2 suffix.
• Decompressed files are produced locally with gzip -dc / bzip2 -dc and verified on the repo by SHA-256 (LFS OID or byte comparison).
• LANL does not publish netflow_day-01.bz2; day-01 netflow is unavailable from the official source.
• manifest.json / manifest.csv (added on completion) record per-file source URL pattern, SHA-256/MD5, compressed size, UTC download time, and integrity results.

Provenance & integrity

• 2015: A. D. Kent, "Comprehensive, Multi-Source Cyber-Security Events," LANL, http://dx.doi.org/10.17021/1179829 (release LA-UR-15-23810). 58 days, ~12 GB compressed, 1.65B events.
• 2017: M. Turcotte, A. Kent, C. Hash, "Unified Host and Network Data Set," Data Science for Cyber-Security, World Scientific, 2018, doi:10.1142/9781786345646_001 (release LA-UR-17-20763). ~90 days of enterprise host + network events.
• Every file passed magic-byte inspection, gzip -t / bzip2 -t, and SHA-256 verification against the downloaded bytes before upload.
• 2017 WLS files were additionally cross-checked against independently recorded hashes.

License

To the extent possible under law, Los Alamos National Laboratory has waived all copyright and related or neighboring rights to both datasets (CC0-style waiver); published from the United States. If you use this data, please cite the sources above and consider downloading future copies directly from https://csr.lanl.gov/data/cyber1/ and https://csr.lanl.gov/data/2017/.