datasets
Training and evaluation data, with the modality, task and licence stated up front. Listed live from the Hugging Face Hub.
threat-intelligence-dataset
Cyber Threat Intelligence Dataset for LLM Fine-Tuning
An instruction-tuning dataset for teaching language models to do cyber threat intelligence work: reading a CVE and explaining what the risk actually is, profiling a threat actor from its ATT&CK techniques, turning a Sigma rule into alert-triage guidance, mapping a campaign's kill chain, writing detection logic for a technique, and so on.
The four splits live under data/; the rest of this card documents how the set was built… See the full description on the dataset page: https://huggingface.co/datasets/reloading0101/threat-intelligence-dataset.cyber-threat-intelligenceatr-skill-benchmark
ATR Skill-Security Benchmark
A labeled corpus of SKILL.md files for evaluating detection of malicious agent
skills — prompt injection, tool poisoning, credential theft, malware droppers
and supply-chain attacks hidden inside natural-language agent instructions.
Published as part of Agent Threat Rules (ATR),
an open, vendor-neutral detection standard for AI agents (like Sigma, but for
agent attacks).
Why this exists
SKILL.md files are natural-language instructions… See the full description on the dataset page: https://huggingface.co/datasets/Agent-Threat-Rule/atr-skill-benchmark.threat-intel-reports
ThreatIntel synthetic reports
32 synthetic English and Persian CTI notes for the ThreatIntel extraction demo. Seed 5.
Organization dataset and collection item are public. Live Gradio (AriaAICompany/threat-intel or alirezaaminzadeh/threat-intel) is created by scripts/publish.py after the daily Space-creation cap resets. This is fixture data (level 1). It does not prove operational extraction quality on real vendor reports. Reports are original laboratory text. They are not copies… See the full description on the dataset page: https://huggingface.co/datasets/AriaAICompany/threat-intel-reports.threat-intelligence-dataset
Cyber Threat Intelligence Dataset for LLM Fine-Tuning
An instruction-tuning dataset for teaching language models to do cyber threat intelligence work: reading a CVE and explaining what the risk actually is, profiling a threat actor from its ATT&CK techniques, turning a Sigma rule into alert-triage guidance, mapping a campaign's kill chain, writing detection logic for a technique, and so on.
The four splits live under data/; the rest of this card documents how the set was built… See the full description on the dataset page: https://huggingface.co/datasets/tonygarg/threat-intelligence-dataset.threat-intelligence-dataset-archive
Cyber Threat Intelligence Dataset for LLM Fine-Tuning
An instruction-tuning dataset for teaching language models to do cyber threat intelligence work: reading a CVE and explaining what the risk actually is, profiling a threat actor from its ATT&CK techniques, turning a Sigma rule into alert-triage guidance, mapping a campaign's kill chain, writing detection logic for a technique, and so on.
The four splits live under data/; the rest of this card documents how the set was built… See the full description on the dataset page: https://huggingface.co/datasets/ChipHolmes/threat-intelligence-dataset-archive.cve-exploitation-signals
CVE exploitation signals
One row per CVE joining reference data (CVSS, CWE, affected vendors and products) with exploitation signals: CISA KEV listing and due date, whether a public exploit is known, and whether the vulnerability is used by ransomware operators.
Built from the ThreatCluster corpus. 60,879 rows, snapshot generated 2026-09-06.
Fields
Field
Description
cve_id
CVE identifier
description
Vulnerability description
published_date
CVE… See the full description on the dataset page: https://huggingface.co/datasets/threatcluster/cve-exploitation-signals.ransomware-leak-site-victims
Ransomware leak-site victims
Every victim listing ThreatCluster has collected first-hand from ransomware and extortion leak sites: the group, the named organisation, when it appeared, and the sector and country where known.
Built from the ThreatCluster corpus. 20,627 rows, snapshot generated 2026-09-06.
Fields
Field
Description
group_name
Ransomware or extortion group that published the listing
victim_name
Organisation named by the group
country… See the full description on the dataset page: https://huggingface.co/datasets/threatcluster/ransomware-leak-site-victims.threat-incident-clusters
Threat incident clusters
Security incidents as deduplicated stories rather than individual articles. Each row is one incident that at least two outlets reported, with a generated title and prose summary, the entities involved, the reporting outlets, scores and the reporting window.
Built from the ThreatCluster corpus. 19,205 rows, snapshot generated 2026-09-06.
Fields
Field
Description
cluster_id
Short identifier; the page is… See the full description on the dataset page: https://huggingface.co/datasets/threatcluster/threat-incident-clusters.cyber-threat-intelligence-splitedHindi-story-news
Hindi Web Content Dataset
Overview
This dataset contains a collection of Hindi text data scraped from various websites. The data was collected using a domain-restricted scraper that extracts paragraphs of text from specified domains. The dataset includes content from news articles, literature, and other web pages. The scraped text has been stored in JSON format and is intended for use in natural language processing (NLP) tasks, such as language modeling, text generation… See the full description on the dataset page: https://huggingface.co/datasets/Threatthriver/Hindi-story-news.mirror-threat-intelligence-dataset
Cyber Threat Intelligence Dataset for LLM Fine-Tuning
An instruction-tuning dataset for teaching language models to do cyber threat intelligence work: reading a CVE and explaining what the risk actually is, profiling a threat actor from its ATT&CK techniques, turning a Sigma rule into alert-triage guidance, mapping a campaign's kill chain, writing detection logic for a technique, and so on.
The four splits live under data/; the rest of this card documents how the set was built… See the full description on the dataset page: https://huggingface.co/datasets/alucent/mirror-threat-intelligence-dataset.cyber-threat-intelligence-relations-onlyETDA-Threat-Actorsthreatactor-telegram-18k18k question and answer pairs generated in Dec of 2024. Initial messages were gathered and then questions were generated through the use of neural-chat
Uses the Alpaca format.
cyber-threat-intel-dataset
🛡️ CyberThreat Intel Dataset
A dataset containing 471 instruction-tuning pairs designed to teach LLMs how to generate automated, structured cybersecurity threat intelligence reports from raw CVE vulnerability data.
💻 Project GitHub: vanshkamra12/CyberThreat-Intel-LLM
🧠 Fine-Tuned Model: vanshkamra12/CyberSecurity-Model
Dataset Structure
Each line is a JSON object with three fields (Alpaca format):
instruction: The prompt asking the model to act as a threat… See the full description on the dataset page: https://huggingface.co/datasets/vanshkamra12/cyber-threat-intel-dataset.cybersecurity-threat-intelligence
🛡️ Cybersecurity threat intelligence dataset (FREE SAMPLE)
🚀 Looking for the full dataset? https://deniks.gumroad.com/l/svgbfp
📌 Overview
This repository contains a free preview (100 high-quality records) of a professionally curated instruction-tuning dataset. It features cleaned cybersecurity threat reports, vulnerability disclosures, and attack summaries formatted explicitly for training Large Language Models (LLMs) on InfoSec summarization and analysis.
🎯… See the full description on the dataset page: https://huggingface.co/datasets/deniks315/cybersecurity-threat-intelligence.sample-threat-scenariosthreat-detection
Defense Threat Detection Dataset
Overview
The Defense Threat Detection Dataset is designed to identify and classify potential security threats across various scenarios. It includes text-based scenarios with associated threat types and detailed explanations, helping models learn to detect and categorize threats in domains such as cyber warfare, espionage, economic sabotage, and industrial espionage.
This dataset is suitable for tasks such as natural language processing… See the full description on the dataset page: https://huggingface.co/datasets/bayrameker/threat-detection.water-infra-threat-mappinghan-distributed-security-threat-intelligence-dataset-v1
Humanoid Distributed Security Threat Intelligence Dataset
This dataset models security threats,
behavioral anomalies,
and coordinated attack patterns
within decentralized humanoid networks.
It captures intrusion signals,
behavior deviation metrics,
and collaborative mitigation responses.
Objective
To enable proactive threat detection
and distributed security reinforcement
across humanoid agents.
Data Fields
agent_id
threat_type
anomaly_score
intrusion_vector… See the full description on the dataset page: https://huggingface.co/datasets/achiepatricia/han-distributed-security-threat-intelligence-dataset-v1.ThreatQwen-detection-datasetinsider_threater
