license: cc-by-4.0
task_categories:
- text-generation
- question-answering
tags: - cybersecurity
- threat-hunting
- mitre-attack
- sigma-rules
- yara
- incident-response
- unsloth
- deepseek-r1
- dpo
- sft
- lora
size_categories: - 1K<n<10K
language: - en
🛡️ Enterprise Cybersecurity AI, SOC Tier-3 & Threat Hunting SFT/DPO Dataset (2026)
High-precision multi-turn instruction tuning and preference optimization dataset with step-by-step SOC Tier-3 Chain-of-Thought (<thought>) kill-chain diagnostic trees for fine-tuning LLMs (Llama-3.3, Qwen-2.5-Coder, DeepSeek-R1-Distill, Mistral) into Senior SOC Threat Hunters, Incident Responders, and Red-Team Defense Architects.
📊 Dataset Architecture & Highlights
- Multi-Turn Incident Negotiations: Simulates corporate security friction (Turn 1: Threat hunting alert -> Turn 2: CISO business continuity objection -> Turn 3: Surgical zero-downtime containment runbook).
- Deterministic Syntactic Verification: 100% of Sigma YAML and YARA rules are verified via programmatic AST linters.
- Hardware & VRAM Profiling: Pre-computed token quantiles ($P_{50} = 826$, $P_{99} = 1109$) and GPU VRAM memory footprint matrix across model sizes.
- 5 Core Cybersecurity Domains:
MITRE ATT&CK Matrix Hunting (Kerberoasting, Cobalt Strike),SIEM Sigma & Splunk SPL Synthesis,Ransomware/Malware Memory Forensics (YARA & Volatility 3),Cloud IAM Privilege Escalation (AWS AssumeRole, Azure Entra ID), andZero-Day CVE Exploit Remediation. - DPO Preference Pairs: 2,500 curated Chosen vs Ineffective/Flawed Rejected pairs with automated security and false-positive failure critiques.
- Pre-packaged Tooling: 1-Click Unsloth Colab Notebook (
1_CLICK_UNSLOTH_CYBER_FINE_TUNING_COLAB.ipynb), LLaMA-Factory YAML, and Axolotl YML configs.
🚀 Quick Start with Hugging Face datasets
from datasets import load_dataset
# Load from Parquet
dataset = load_dataset("parquet", data_files="CYBERSECURITY_SOC_THREAT_HUNTING_SFT_DPO_2026_100_SAMPLE.parquet", split="train")
print(f"Loaded {len(dataset)} sample Cybersecurity training instances!")
print("Sample Alert:", dataset[0]["user_prompt"])
print("Sample Hardened Detection Rule:", dataset[0]["clean_rule"])
👑 Get the Complete 10,000 SFT + 2,500 DPO Enterprise Suite
Need the complete production-grade package with 10,000 multi-turn SFT pairs, 2,500 DPO pairs, pre-packaged Train/Val/Test splits, full 62.5 MB SQLite DB, and commercial enterprise deployment rights?