MAGNEXIS · DATA RELEASE
T-Pot Evidence Lab
Honeypot observations and 12,066 defensive scenarios. Traceable sources, explicit uncertainty, and a clear boundary between evidence and inference.
VERSION 3.2.2 · RESEARCH DATA
Inspect a defensive reasoning example.
12,066 conversations: 1,100 local triage/review examples, 7,016 CISA KEV task variants, and 3,950 MITRE ATT&CK mitigation/detection examples. Weak labels and recurring templates require human review. No model has been trained.
Loading bounded example preview…
Input
Loading…
Inspect the proposed response and uncertainty
These are actual release rows, one example per task. Browse all defensive scenarios.
What’s inside
- 133,137 structured observations across 14 sensor types
- 741 original local events and 132,396 imported cloud honeynet observations
- Chat, Alpaca, ShareGPT, prompt/completion, JSONL, and Parquet formats
- Source-group-disjoint splits within each collection; cross-collection overlap is unknown
- Local Ollama and generic Harness² evaluation bridges
COLLECTIONS
Two sources. Clear boundaries.
| Collection | Rows | Capture | License |
|---|---|---|---|
| Magnexis local | 741 | October 20, 2026 | CC BY 4.0 |
| Multi-Regional Cloud Honeynet | 132,396 | June 9–11, 2025 | MIT |
Cloud source: Enrique Feito-Casares, Ismael Gómez-Talal, José Luis Rojo-Álvarez · Universidad Rey Juan Carlos. Identifiers and sensitive fields were removed; 29 identical projected rows were collapsed. Imported observations remain unlabelled.
OBSERVATION PREVIEW
Inspect the shape of the data.
Up to 20 real records per collection and sensor. Filters search this bounded preview. Explore all rows on Hugging Face.
Loading observation preview…
| Record | UTC timestamp | Sensor | Protocol | Port | Label basis |
|---|
Choose the right configuration
Combined Parquet observations · Original detailed events · Original chat examples
Expanded defensive scenarios · Retained local events
9,229 / 1,413 / 1,424 conversational train / validation / test rows. Original and new snapshots overlap: do not add the counts or mix their evaluation splits. Local exact times are removed from the new configurations. Existing public observation times remain unchanged.
from datasets import load_dataset
events = load_dataset("Magnexis/tpot-evidence-lab", "observations")
print(events["train"][0])Methods, rights and responsible use
Original labels are weak deterministic thresholds. Imported rows have no fabricated answers. Neither establishes identity, intent, compromise, or botnet membership. Addresses, locations, credentials, commands, and raw payloads are excluded, but timing may still allow linkage with upstream records.
New schema and label methodology · Source-specific licenses · Versioned release and checksums