Large, messy, production-sized security datasets. The open-source tools to analyze them, installed and configured.
Useful datasets are sold under vendor contracts. Useful tooling assumes you already have a cluster and someone to run it. If you have neither, you learn on small synthetic samples and hope the lessons transfer to production.
We think the data and the tools should be public, so that's what Seacurity is.
Logs, packet captures, threat intelligence feeds, and recorded attack traces, at the volumes you'd see in a real environment. Each dataset has a schema, a version history, and a license. Download it or query it where it sits.
Open-source detection engines, parsers, hunting notebooks, and visualizers, installed and configured. The same code is on GitHub if you'd rather run it yourself.
Hosted workspaces with the datasets already mounted. You can run a query over a few billion events without provisioning anything first.
The people with the least access to real security data are the ones who could use it most.
Graduate students, small security teams, independent researchers, people teaching the subject. The data exists. Most of it is under contract.
Seacurity is an attempt to fix that by collecting what can be released, cleaning it, and hosting it with the tools needed to use it.
Self-funding and donations.
No grants, sponsors, or institutional backers. The code and data are licensed so the project can continue even if we can't.
1dataset: win-auth-lab/v32source: instrumented lab network3hosts: 4004span: 90 days5labels: 14 lateral-movement sequences6license: CC-BY-NC-4.07covers: 4624, 4625, 4648, 46728excludes: Kerberos pre-auth failures
Full catalog opens at launch.
90 days of Windows authentication events from a 400-host instrumented lab network, with 14 labelled lateral-movement sequences.
Every card says what the data isn't.
Gaps, synthetic portions and anonymisation are stated on the card, not discovered halfway through an analysis.
Download and query-in-place unlock when the catalog opens.
Nothing is paid. There are no usage tiers or trial periods, and nothing on the site requires talking to a salesperson.
Datasets carry a license. Tools are open source. The collection and cleaning methods are written up so you can reproduce them.
Large, noisy, inconsistently formatted. Cleaning that up is part of the work, and you should get to practice it.
Every dataset is reviewed. Where we can't anonymize confidently, we generate synthetic data or leave the field out.
Roadmap decisions are made in the open, and contributions are credited by name.
If you have a dataset that could be released, a tool worth adding, or a tutorial to write, the contributor guide explains how to submit it and what review looks like.
A dataset that could be released, with a data card.
Open-source software worth installing for everyone.
A walkthrough that teaches with real data.
Every submission is reviewed and credited by name.
# datacard.yamlname: your-datasetsource: contributed | lab | syntheticcollection: how it was gatheredcoverage: what it includesexcludes: what it does notlicense: CC-BY-NC-4.0pii_review: required before publish
Contributor guide and discussion forum open before launch.
Nothing here requires talking to a salesperson. If it isn't covered, get in touch.
Yes. Seacurity is self-funded, plus donations — no grants, sponsors, or institutional backers. There is no paid tier and no plan to add one.
No. The data is free for research, education, and training — not for commercial use. The exact license terms are on each data card.
Three sources: corpora contributed by organizations, instrumented lab environments we run, and synthetic generation. The data card for each dataset says which.
It shouldn't be. Every release is reviewed and personal data is anonymized or removed. If you find something we missed, report it and we'll pull the affected version.
Not to browse or download. Workspaces and contributions require one so we can save your work and attribute it.
Get in touch with a description of the project. We extend resources for research groups, courses, and open-source work on a case-by-case basis.
Yes. Everything is on GitHub with packaging for self-hosting. The hosted version exists to skip setup, not to lock you in.
One email when we publish new datasets or tools. Roughly monthly.
No account needed. Unsubscribe in one click.