Datasetpublic

TitleOS/Meridian-SFT-600

Meridian-SFT-500 500 synthetic purple team SFT examples generated from the full MITRE ATT&CK Enterprise technique corpus across nine generation angles. Intended for supervised fine-tuning of red team and security-focused LLMs. What's in it Each entry pairs an ATT&CK-contextualized prompt with a structured security analysis demonstrating simultaneous offensive and defensive knowledge. The dataset spans all 11 Enterprise tactics and covers both Windows and Linux… See the full description on the dataset page: https://huggingface.co/datasets/TitleOS/Meridian-SFT-600.

sourceHugging Faceotherupdated 2mo agoView on Hugging Face

1likes26downloads

Dataset Card

Meridian-SFT-500

500 synthetic purple team SFT examples generated from the full MITRE ATT&CK Enterprise technique corpus across nine generation angles. Intended for supervised fine-tuning of red team and security-focused LLMs.

What's in it

Each entry pairs an ATT&CK-contextualized prompt with a structured security analysis demonstrating simultaneous offensive and defensive knowledge. The dataset spans all 11 Enterprise tactics and covers both Windows and Linux platforms.

Generated by purple-team-gen using a locally-hosted Qwen3.6-27B-uncensored-heretic-v2 inference server. Thinking mode was disabled during generation. All entries passed a quality gate: minimum 900 character response, refusal pattern detection, SIGMA YAML syntax validation where applicable, and mandatory code block presence.

Generation angles

Each technique is approached from one of nine angles, distributed across the 500 entries:

Angle	What it produces
`simulate_and_detect`	Attack implementation + SIGMA rule + remediation
`detection_engineering`	Behavioral indicators + SIGMA + Splunk hunt query
`redteam_operator`	Evasion-aware code + artifact footprint + cleanup
`security_tooling`	Offensive tool + companion detection script
`sample_analysis`	Malicious code sample + technical breakdown + YARA rule
`attack_chain`	Multi-stage kill chain with this technique as a step
`incident_triage`	Alert analysis + triage script + containment procedure
`hardening_guide`	Configuration hardening + monitoring setup + verification
`threat_modeling`	Attack paths + risk assessment + control mapping

Format

ChatML JSONL. One record per line:

json

{
  "messages": [
    {"role": "system", "content": "..."},
    {"role": "user",   "content": "..."},
    {"role": "assistant", "content": "..."}
  ],
  "metadata": {
    "technique_id":   "T1055.001",
    "technique_name": "Process Injection: Dynamic-link Library Injection",
    "tactics":        ["defense-evasion", "privilege-escalation"],
    "platforms":      ["Windows"],
    "angle":          "simulate_and_detect",
    "generated_at":   "2026-07-24T...",
    "source":         "purple-team-gen"
  }
}

Loading

python

import json
from datasets import load_dataset

# From HuggingFace
ds = load_dataset("TitleOS/Meridian-SFT-500", split="train")

# Or directly from JSONL
with open("meridian-sft-500.jsonl") as f:
    records = [json.loads(line) for line in f]

messages  = records[0]["messages"]   # ChatML turns, ready for tokenization
technique = records[0]["metadata"]["technique_id"]
angle     = records[0]["metadata"]["angle"]

Statistics


Total entries	593
Unique technique IDs	~280
Enterprise tactics covered	All 11
Angles with SIGMA rules	`simulate_and_detect`, `detection_engineering`, `attack_chain`, `threat_modeling`
Entries with fenced code blocks	500 (100%)
Source STIX bundle	MITRE ATT&CK Enterprise (latest)
Generator model	Qwen3.6-27B-uncensored-heretic-v2

Intended use

SFT data for LLMs targeting:

—Red team and purple team agentic workflows
—Codebase vulnerability auditing with remediation
—Detection rule generation (SIGMA, YARA, SPL)
—Security tool development
—Threat modeling and incident response

Not intended for production deployment without human review, or any use outside authorized, scoped security testing engagements.

What it isn't

This is a small sample dataset — 593 entries across ~697 Enterprise techniques means roughly one angle per technique on average. It is suitable as a representative slice for dataset mixing or evaluation, not as a standalone fine-tuning corpus. For a full-coverage run (all techniques × all 9 angles ≈ 5,000+ entries), see the purple-team-gen pipeline.

The synthetic nature of the content means some technical specifics (API signatures, event IDs, file paths) may not be accurate to every real-world environment. Human review before operational use is required.

License

MPL-2.0 with Commons Clause. Licensor: TitleOS.

The Commons Clause restricts selling this dataset or services whose value derives substantially from it. See LICENSE for full terms.