Merge pull request #1175 from splunk/abroddata

rosplk · web-flow · commit d69d6e7abb3c · 2026-06-08T15:52:53.000-04:00
datasets aws_bedr
diff --git a/.gitattributes b/.gitattributes
@@ -1,3 +1,4 @@
 *.log filter=lfs diff=lfs merge=lfs -text
 *.log   text encoding=utf-8
 datasets/**/*.json filter=lfs diff=lfs merge=lfs -text
+datasets/**/*.ndjson filter=lfs diff=lfs merge=lfs -text
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude.yml b/datasets/aws_bedrock_claude/aws_bedrock_claude.yml
@@ -0,0 +1,30 @@
+author: Rod Soto, Splunk
+id: 286f9904-49f7-417c-a6a8-51cd9b45cd3d
+date: '2026-05-20'
+description: Generated datasets for AWS Bedrock Claude using synthetic model invocation log simulation
+environment: attack_range
+directory: aws_bedrock_claude
+mitre_technique:
+- T1055
+- T1599
+datasets:
+- name: aws_bedrock_claude_cross_region_possible_inference_abuse
+  path: /datasets/aws_bedrock_claude/aws_bedrock_claude_cross_region_possible_inference_abuse.ndjson
+  sourcetype: json_no_timestamp
+  source: http:bulkawsbedrock
+- name: aws_bedrock_claude_hostile_prompt_sentiment
+  path: /datasets/aws_bedrock_claude/aws_bedrock_claude_hostile_prompt_sentiment.ndjson
+  sourcetype: json_no_timestamp
+  source: http:bulkawsbedrock
+- name: aws_bedrock_claude_possible_prompt_injection
+  path: /datasets/aws_bedrock_claude/aws_bedrock_claude_possible_prompt_injection.ndjson
+  sourcetype: json_no_timestamp
+  source: http:bulkawsbedrock
+- name: aws_bedrock_claude_sensitive_data_in_prompts
+  path: /datasets/aws_bedrock_claude/aws_bedrock_claude_sensitive_data_in_prompts.ndjson
+  sourcetype: json_no_timestamp
+  source: http:bulkawsbedrock
+- name: aws_bedrock_claude_unusually_large_prompts
+  path: /datasets/aws_bedrock_claude/aws_bedrock_claude_unusually_large_prompts.ndjson
+  sourcetype: json_no_timestamp
+  source: http:bulkawsbedrock
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude_cross_region_possible_inference_abuse.ndjson b/datasets/aws_bedrock_claude/aws_bedrock_claude_cross_region_possible_inference_abuse.ndjson
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3e1d1f9545461135c27c13358191ef35ed8de0a758204f8aea8dba82c33edbf7
+size 5322
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude_excessive_use_of_tokens.ndjson b/datasets/aws_bedrock_claude/aws_bedrock_claude_excessive_use_of_tokens.ndjson
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:26329e542bf144b6c37d9e29339db2cdc5d9166e04aaeadb18cec42d2cb334d4
+size 27408
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.ndjson b/datasets/aws_bedrock_claude/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.ndjson
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9952eb7087c0e57a1e89cd79ebb8751597dfc62bd85373503e903b77bf19f7fa
+size 24645
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude_hostile_prompt_sentiment.ndjson b/datasets/aws_bedrock_claude/aws_bedrock_claude_hostile_prompt_sentiment.ndjson
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7ad872c15d4ed36cc9b136e797497e55a82a41cfcb298db1cd52954d73eb4ce4
+size 19420
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude_possible_prompt_injection.ndjson b/datasets/aws_bedrock_claude/aws_bedrock_claude_possible_prompt_injection.ndjson
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:65acd12ab48dab873c36a8d07b79b5d9a80c85759917e4d4155979dce37ceb65
+size 19662
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude_sensitive_data_in_prompts.ndjson b/datasets/aws_bedrock_claude/aws_bedrock_claude_sensitive_data_in_prompts.ndjson
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a944475ddac2cdf29d8ef8f66b3288d624d5d3a3e8b8c91e7267832a72b3c8a3
+size 19081
diff --git a/datasets/aws_bedrock_claude/aws_bedrock_claude_unusually_large_prompts.ndjson b/datasets/aws_bedrock_claude/aws_bedrock_claude_unusually_large_prompts.ndjson
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:45da118ad888e1baf39685b5c3f64432764114148d0fb8329d4b35296d5ed433
+size 164900

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:3e1d1f9545461135c27c13358191ef35ed8de0a758204f8aea8dba82c33edbf7`
	`3`	`+size 5322`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:26329e542bf144b6c37d9e29339db2cdc5d9166e04aaeadb18cec42d2cb334d4`
	`3`	`+size 27408`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:9952eb7087c0e57a1e89cd79ebb8751597dfc62bd85373503e903b77bf19f7fa`
	`3`	`+size 24645`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:7ad872c15d4ed36cc9b136e797497e55a82a41cfcb298db1cd52954d73eb4ce4`
	`3`	`+size 19420`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:65acd12ab48dab873c36a8d07b79b5d9a80c85759917e4d4155979dce37ceb65`
	`3`	`+size 19662`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:a944475ddac2cdf29d8ef8f66b3288d624d5d3a3e8b8c91e7267832a72b3c8a3`
	`3`	`+size 19081`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:45da118ad888e1baf39685b5c3f64432764114148d0fb8329d4b35296d5ed433`
	`3`	`+size 164900`