From Production SIEM to Reusable Cybersecurity Artifacts
For cybersecurity researchers and SOC operators, this work provides a principled way to transform sensitive production telemetry into reusable datasets, addressing the long-standing problem of inaccessible real-world data for security research.
The paper introduces a methodology to extract, anonymize, structure, and validate production SIEM data from a financial SOC into reusable research artifacts, demonstrating a measurable privacy-utility boundary. Two stress tests show that the artifacts preserve task-relevant structure: 37 MITRE ATT&CK-mapped challenges work only when anonymization maintains temporal order and entity consistency, and a deterministic verifier detects non-compliant LLM actions across 200 incidents.
Operational evidence is not automatically scientific evidence. The most realistic Security Operations Center (SOC) data is production telemetry, yet it remains scientifically inaccessible because raw logs cannot be released; as a result, research relies on synthetic or dated datasets. We treat the boundary between private production telemetry and reusable research artifacts as the design object: a methodology that extracts, anonymizes, structures, and validates Security Information and Event Management (SIEM) data from a production financial SOC while preserving task-relevant investigative structure within a declared privacy boundary. Two consumers stress the same artifact. As training material, it fails loudly: 37 MITRE ATT&CK-mapped HIKARI challenges work only when anonymization preserves temporal order and entity consistency. As a measurement substrate, it fails quietly: across 200 SOCpilot incidents, a deterministic verifier detects non-compliant Large Language Model (LLM) actions that are absent from the human baseline. The result is a measurable privacy-utility boundary rather than a formal anonymity claim.