Lab 001: Meridian workstation intrusion

Roughly three days of endpoint, identity, and network telemetry from a small Windows domain (meridian.internal) with an intrusion inside. See labs/001 for the scenario, environment, and question set.

Assets

• bifract-labs-001.jsonl.zst: 2,083,151 events, one JSON object per line, newest first
• SHA256SUMS

sha256sum -c SHA256SUMS
zstd -d bifract-labs-001.jsonl.zst

Safety: attacker domains are fictional and attacker IPs come from documentation ranges. Do not resolve or contact any indicator from the dataset.

Licensed under CC BY 4.0.