alirezaaminzadeh/

soc-agent-traces-100k

Multi-step SOC investigation agent traces in session-trace format. Each record is a complete investigation session: an alert arrives, an analyst agent gathers evidence through nine read-only tools, and closes with a structured JSON triage report. Instead of single-turn alert → answer pairs, every record captures the full reasoning trajectory: alert → get_surrounding_events → get_process_tree → lookup_attack → search_sigma → get_asset_context →… See the full description on the dataset page: https://huggingface.co/datasets/alirezaaminzadeh/soc-agent-traces-100k.