How nutthakorn7/salad-soc works
SALAD is a published SOC-alert benchmark dataset, not an alert-processing service. Its main user workflow is to load the prepared train/test splits and evaluate models on four tasks: malicious-alert classification, triage, priority scoring, and attack categorization. The README also documents enriched alert labels and a validation split. The sampled evaluation code shows feature preparation and model fitting; dataset creation and enrichment implementation are not present in this repository, so those are represented only as published data capabilities.
Main entry points: evaluate.py Evaluation CLI · salad_train.csv Training Split · README.md Enriched Alert Schema · salad_test.csv Test Split
Components 13
Benchmark Data
- Training Split
salad_train.csv - Validation Split
salad_val.csv - Test Split
salad_test.csv - Enriched Alert Schema
README.md - Dataset Statistics
stats.json
Model Evaluation
- Evaluation CLI
evaluate.py - Feature Preparation
evaluate.py - Alert Classification
evaluate.py - Alert Triage
evaluate.py - Priority Scoring
evaluate.py - Attack Categorization
evaluate.py
Other components
- CIC-IDS2017
- UNSW-NB15
Connections 12
- CIC-IDS2017 → Training Split: contributes alerts
README.md - UNSW-NB15 → Training Split: contributes alerts
README.md - Training Split → Enriched Alert Schema: includes fields
README.md - Validation Split → Enriched Alert Schema: includes fields
README.md - Test Split → Enriched Alert Schema: includes fields
README.md - Evaluation CLI → Training Split: reads data
evaluate.py - Evaluation CLI → Test Split: reads data
evaluate.py - Evaluation CLI → Feature Preparation: prepares features
evaluate.py - Evaluation CLI → Alert Classification: runs task
evaluate.py - Evaluation CLI → Alert Triage: runs task
evaluate.py - Evaluation CLI → Priority Scoring: runs task
evaluate.py - Evaluation CLI → Attack Categorization: runs task
evaluate.py