{
  "k8s": {
    "behavior_label_instances": 163,
    "files": [
      "examples/k8s/example_sessions.jsonl",
      "examples/k8s/example_gold.rev20.jsonl"
    ],
    "intrusion_rows": 72,
    "normal_rows": 72,
    "rows": 144,
    "rows_with_behavior_labels": 144,
    "sessions": 46,
    "source": "public normalized Kubernetes AuditLog examples with public-only metadata",
    "unique_behavior_labels": 27
  },
  "linux": {
    "behavior_label_instances": 14807,
    "files": [
      "examples/linux/example_sessions.jsonl",
      "examples/linux/example_gold.rev20.jsonl"
    ],
    "intrusion_rows": 7586,
    "normal_rows": 2934,
    "rows": 10520,
    "rows_with_behavior_labels": 10019,
    "sessions": 531,
    "source": "publicly releasable subset of the internal Linux final benchmark; session labels normalized to English enums",
    "unique_behavior_labels": 349
  },
  "note": "The full internal benchmark is larger and is not redistributed in this repository; these examples are the public subset used for runnable release verification.",
  "schema": "secebl_public_examples_manifest_v2"
}