language:
- en
license: other
license_name: mpl-2.0-commons-clause
tags: - security
- red-team
- purple-team
- cybersecurity
- synthetic
- sft
- mitre-attack
- agentic
- tool-use
size_categories: - n<1K
task_categories: - text-generation
Meridian-SFT-500
500 synthetic purple team SFT examples generated from the full MITRE ATT&CK
Enterprise technique corpus across nine generation angles. Intended for
supervised fine-tuning of red team and security-focused LLMs.
What's in it
Each entry pairs an ATT&CK-contextualized prompt with a structured security
analysis demonstrating simultaneous offensive and defensive knowledge. The
dataset spans all 11 Enterprise tactics and covers both Windows and Linux
platforms.
Generated by purple-team-gen
using a locally-hosted Qwen3.6-27B-uncensored-heretic-v2 inference server.
Thinking mode was disabled during generation. All entries passed a quality
gate: minimum 900 character response, refusal pattern detection, SIGMA YAML
syntax validation where applicable, and mandatory code block presence.
Generation angles
Each technique is approached from one of nine angles, distributed across the
500 entries:
| Angle | What it produces |
|---|---|
simulate_and_detect |
Attack implementation + SIGMA rule + remediation |
detection_engineering |
Behavioral indicators + SIGMA + Splunk hunt query |
redteam_operator |
Evasion-aware code + artifact footprint + cleanup |
security_tooling |
Offensive tool + companion detection script |
sample_analysis |
Malicious code sample + technical breakdown + YARA rule |
attack_chain |
Multi-stage kill chain with this technique as a step |
incident_triage |
Alert analysis + triage script + containment procedure |
hardening_guide |
Configuration hardening + monitoring setup + verification |
threat_modeling |
Attack paths + risk assessment + control mapping |
Format
ChatML JSONL. One record per line:
{
"messages": [
{"role": "system", "content": "..."},
{"role": "user", "content": "..."},
{"role": "assistant", "content": "..."}
],
"metadata": {
"technique_id": "T1055.001",
"technique_name": "Process Injection: Dynamic-link Library Injection",
"tactics": ["defense-evasion", "privilege-escalation"],
"platforms": ["Windows"],
"angle": "simulate_and_detect",
"generated_at": "2026-07-24T...",
"source": "purple-team-gen"
}
}
Loading
import json
from datasets import load_dataset
# From HuggingFace
ds = load_dataset("TitleOS/Meridian-SFT-500", split="train")
# Or directly from JSONL
with open("meridian-sft-500.jsonl") as f:
records = [json.loads(line) for line in f]
messages = records[0]["messages"] # ChatML turns, ready for tokenization
technique = records[0]["metadata"]["technique_id"]
angle = records[0]["metadata"]["angle"]
Statistics
| Total entries | 593 |
| Unique technique IDs | ~280 |
| Enterprise tactics covered | All 11 |
| Angles with SIGMA rules | simulate_and_detect, detection_engineering, attack_chain, threat_modeling |
| Entries with fenced code blocks | 500 (100%) |
| Source STIX bundle | MITRE ATT&CK Enterprise (latest) |
| Generator model | Qwen3.6-27B-uncensored-heretic-v2 |
Intended use
SFT data for LLMs targeting:
- Red team and purple team agentic workflows
- Codebase vulnerability auditing with remediation
- Detection rule generation (SIGMA, YARA, SPL)
- Security tool development
- Threat modeling and incident response
Not intended for production deployment without human review, or any use
outside authorized, scoped security testing engagements.
What it isn't
This is a small sample dataset — 593 entries across ~697 Enterprise
techniques means roughly one angle per technique on average. It is suitable
as a representative slice for dataset mixing or evaluation, not as a
standalone fine-tuning corpus. For a full-coverage run (all techniques × all
9 angles ≈ 5,000+ entries), see the purple-team-gen pipeline.
The synthetic nature of the content means some technical specifics (API
signatures, event IDs, file paths) may not be accurate to every real-world
environment. Human review before operational use is required.
License
MPL-2.0 with Commons Clause. Licensor: TitleOS.
The Commons Clause restricts selling this dataset or services whose value
derives substantially from it. See LICENSE for full terms.