# SecEBL Public Final Benchmark Examples

This directory contains publicly releasable example data for verifying the
release code path: a subset of the internal Linux final benchmark plus
normalized Kubernetes AuditLog examples.

**The full internal benchmark, training corpora, private pressure-stream rows,
and removed sensitive benchmark sessions are not distributed in this GitHub
repository.**

The `*_gold.rev20.jsonl` filenames are kept for compatibility. In this release,
they are the expected Rev20 behavior-tag labels for this public benchmark
subset.

- `linux/example_sessions.jsonl`: 10,520 Linux command-session rows from 531
  public subset sessions.
- `linux/example_gold.rev20.jsonl`: matching Rev20 behavior tags for the same
  10,520 rows.
- `k8s/example_sessions.jsonl`: 144 normalized Kubernetes AuditLog rows across
  46 sessions.
- `k8s/example_gold.rev20.jsonl`: matching Rev20 behavior tags for the same 144
  K8s rows, with 163 behavior-label instances and 27 unique behavior tags.

Session-level labels use English enums: `normal_operation` and `intrusion`.