examples/README.md

SecEBL Public Final Benchmark Examples

This directory contains publicly releasable example data for verifying the release code path: a subset of the internal Linux final benchmark plus normalized Kubernetes AuditLog examples.

The full internal benchmark, training corpora, private pressure-stream rows, and removed sensitive benchmark sessions are not distributed in this GitHub repository.

The *_gold.rev20.jsonl filenames are kept for compatibility. In this release, they are the expected Rev20 behavior-tag labels for this public benchmark subset.

• linux/example_sessions.jsonl: 10,520 Linux command-session rows from 531 public subset sessions.
• linux/example_gold.rev20.jsonl: matching Rev20 behavior tags for the same 10,520 rows.
• k8s/example_sessions.jsonl: 144 normalized Kubernetes AuditLog rows across 46 sessions.
• k8s/example_gold.rev20.jsonl: matching Rev20 behavior tags for the same 144 K8s rows, with 163 behavior-label instances and 27 unique behavior tags.

Session-level labels use English enums: normal_operation and intrusion.