Merge pull request #1036 from splunk/fsutil

add fsutil symlinkevaluation dataset

Author: nasbench

datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:055f282a2c4f1396db511c10ed4016241072fcbfb78e8de64f6614601c554109
+size 1949

datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval.yml

@@ -0,0 +1,13 @@
+author: Nasreddine Bencherchali, Splunk
+id: 169da367-87f4-413d-b0c9-b8c13e01d489
+date: '2025-10-07'
+description: Generated datasets for fsutil SymlinkEvaluation set in attack range.
+environment: attack_range
+directory: fsutil_symlink_eval
+mitre_technique:
+- T1222.001
+datasets:
+- name: fsutil_symlink_eval.log
+  path: /datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/ollama/ollama_server_data.yml

@@ -3,6 +3,7 @@ id: 9d1f6bd1-754a-481c-ad54-5a837f86d12b
 date: '2025-10-05'
 description: Logs from Ollama server, contain errors, system messages, http calls, methods and endpoint uris.
 mitre_technique: []
+environment: attack_range
 datasets:
 - name: ollama_server_data
   path: /datasets/ollama/server.log