SALAD: SOC Alert Labeled Analysis Dataset

WARNING: Known issues (added 2026-11-06). As published, SALAD is not a valid measure of model skill. For new work, use SALAD-v2, a leak-screened rebuild. Label leakage. If alert_type or alert_description is part of the model input, the answer is in the input. Across all 2,778,424 rows, (source_dataset, alert_type) determines attack_category with no exceptions (17 of 17 pairs), and alert_type == normal_traffic is exactly is_malicious == False. In the test split, alert_description comes from 14 templates, 13 of which map to a single attack_category. Rule-derived targets. triage_decision, priority_score and severity are deterministic rule transforms, not analyst judgments or independent ground truth. A high score on these targets recovers the rule and does not show triage skill. Record-level random split. The split is random within each attack_category + source_dataset group (70/15/15, seed 42), so near-identical alerts appear across splits: 96.8% of test rows (403,321 of 416,781) match a validation row on nine structured fields. Cross-source label names (added 2026-11-07). The two sources name reconnaissance scanning differently: every CIC-IDS2017 reconnaissance_scan alert (90,694) is labeled Port Scanning with MITRE tactic Discovery and technique T1046, and every UNSW-NB15 one (13,987) is labeled Reconnaissance with tactic Reconnaissance and technique T1595. The official splits contain both sources, but a subset or split drawn unevenly from the two sources can train on one name and grade the other. Harmonize attack_category across sources, or report results per source, before training or scoring. Row counts. The actual splits are train 1,944,887, validation 416,756 and test 416,781. Details: github.com/nutthakorn7/SALAD-SOC. SALAD (SOC Alert Labeled Analysis Dataset) is a unified benchmark dataset containing 2,778,424 SOC alerts derived from CIC-IDS2017 and UNSW-NB15. Each alert includes MITRE ATT&CK mapping, triage decisions, priority scores, and natural language descriptions. Includes 4 benchmark tasks with evaluation scripts.