Shomi28/cyber-threat-intelligence

Cyber Threat Intelligence Dataset

A comprehensive cybersecurity dataset combining CVE vulnerability data, MITRE ATT&CK techniques, and CISA Known Exploited Vulnerabilities — structured for AI/ML training and security research.

Author: Soham Dahivalkar License: MIT Created: 2026

Dataset Description

This dataset provides structured cybersecurity intelligence data collected from three authoritative public sources:

1. 1.NVD (National Vulnerability Database) — CVE vulnerability records with CVSS scoring
2. 2.MITRE ATT&CK — Enterprise attack techniques, tactics, and detection methods
3. 3.CISA KEV — Known Exploited Vulnerabilities actively used in the wild

Each CVE record is enriched with:

• —CVSS v3.1 base scores and detailed metrics
• —Attack type classification (mapped from CWE)
• —MITRE ATT&CK tactic mapping
• —Custom risk scoring (0-100)
• —CISA KEV status (actively exploited or not)
• —Ransomware usage indicators

Additionally, the dataset includes instruction-tuning data for fine-tuning LLMs as cybersecurity analysts.

Dataset Structure

Configurations

CVE Data Schema

Instruction Data Schema

Instruction types include:

• —CVE vulnerability analysis
• —Remediation recommendations
• —Risk scoring assessments
• —MITRE ATT&CK mapping
• —Triage prioritization decisions
• —MITRE technique explanations

Usage

Load the Dataset

from datasets import load_dataset

# Load all splits
dataset = load_dataset("soham-dahivalkar/cyber-threat-intelligence")

# Access CVE data
cve_data = dataset["cve_data"]
print(f"Total CVEs: {len(cve_data)}")
print(cve_data[0])

# Access MITRE techniques
mitre = dataset["mitre_attack"]
print(f"Total techniques: {len(mitre)}")

# Access training data
train = dataset["train"]
print(f"Training samples: {len(train)}")
print(train[0]["instruction"])

Filter Critical Vulnerabilities

critical_cves = cve_data.filter(lambda x: x["risk_level"] == "CRITICAL")
print(f"Critical CVEs: {len(critical_cves)}")

Get Actively Exploited CVEs

exploited = cve_data.filter(lambda x: x["in_cisa_kev"] == "True")
print(f"Actively exploited CVEs: {len(exploited)}")

Use for Fine-Tuning

# Ready-to-use instruction format
for sample in dataset["train"]:
    instruction = sample["instruction"]
    input_text = sample["input"]
    output = sample["output"]
    # Format for your model and train!

Data Sources

All data is collected from publicly available, free government and community sources.

Intended Uses

• —Fine-tuning LLMs for cybersecurity analysis tasks
• —Training classifiers for vulnerability severity prediction
• —Building RAG systems for security knowledge retrieval
• —Research on automated vulnerability assessment
• —Education on cybersecurity threat intelligence

Limitations

• —CVE descriptions are sourced from NVD and may not reflect the latest updates
• —Risk scores are computed using a custom formula and may differ from organizational assessments
• —MITRE ATT&CK mappings from CWE are approximate and based on common associations
• —The instruction-tuning data is synthetically generated from structured fields

About the Author

Soham Dahivalkar — Generative AI Engineer specializing in agentic AI systems, enterprise RAG, and cybersecurity intelligence.

• —Published Author: "Generative AI: High Stakes Cyber Security" (Amazon Kindle)
• —Research: "AI in Security: ML Approach for Vulnerability Management" (ResearchGate)
• —Open Source: ai-bridge-kit — Unified Python SDK for AI Providers (PyPI)
• —Experience: Alembic Pharmaceuticals, CyberNX Technologies, TalaKunchi Networks
• —LinkedIn: Soham Dahivalkar

Citation

@dataset{dahivalkar2026cyberthreat,
  author = {Dahivalkar, Soham},
  title = {Cyber Threat Intelligence Dataset},
  year = {2026},
  publisher = {HuggingFace},
  url = {https://huggingface.co/datasets/soham-dahivalkar/cyber-threat-intelligence}
}