Lab 001: Meridian workstation intrusion¶
Dataset windows sysmon zeek training
Three days of endpoint and network telemetry from a small Windows domain, with an intrusion inside it. Sysmon, Windows event logs, Zeek and Velociraptor Autoruns from a domain controller, three workstations and a network sensor. Domains and attacker infrastructure are fictional; do not contact any indicator in it.
From: Bifract Labs
Add it¶
In Bifract, open Exchange, find Lab 001: Meridian workstation intrusion and click Add. Creates a fractal named after the dataset and imports its logs into it. Needs a tenant admin.
Data¶
| Setting | Value |
|---|---|
| Fractal | bifract-labs-001 |
| Logs | 2,083,151 |
| Time range | 2026-10-27T08:37:53Z to 2026-10-30T13:49:59Z |
| File | https://github.com/zaneGittins/bifract-labs/releases/download/lab-001/bifract-labs-001.jsonl.zst |
| Size | 118 MB |
| SHA-256 | 2583aeee2a941d6ea32aedd9af7fb11a95403fbdc091d34e146fb99fa760fbc5 |
To load it with the CLI instead, into the fractal an ingest token points at: