Buckets:
| [ | |
| { | |
| "Instruction": "Explain the concept clearly for a cybersecurity trainee. Focus on CIA triad in foundational security reasoning.", | |
| "Input": "An organization is improving its foundational security reasoning program and wants training guidance on CIA triad. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nCIA triad matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in foundational security reasoning. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by CIA triad.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor CIA triad, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "core-security-concepts", | |
| "subdomain": "CIA triad", | |
| "difficulty": "beginner", | |
| "task_type": "explanation", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Create a practical defensive checklist for an authorized security team. Focus on asset inventory in foundational security reasoning.", | |
| "Input": "An organization is improving its foundational security reasoning program and wants training guidance on asset inventory. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nasset inventory matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in foundational security reasoning. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by asset inventory.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor asset inventory, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "core-security-concepts", | |
| "subdomain": "asset inventory", | |
| "difficulty": "intermediate", | |
| "task_type": "checklist", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Analyze the scenario and recommend safe next steps. Focus on least privilege in foundational security reasoning.", | |
| "Input": "An organization is improving its foundational security reasoning program and wants training guidance on least privilege. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nleast privilege matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in foundational security reasoning. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by least privilege.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor least privilege, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "core-security-concepts", | |
| "subdomain": "least privilege", | |
| "difficulty": "advanced", | |
| "task_type": "analysis", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Write a concise response playbook for an internal security team. Focus on defense in depth in foundational security reasoning.", | |
| "Input": "An organization is improving its foundational security reasoning program and wants training guidance on defense in depth. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\ndefense in depth matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in foundational security reasoning. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by defense in depth.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor defense in depth, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "core-security-concepts", | |
| "subdomain": "defense in depth", | |
| "difficulty": "intermediate", | |
| "task_type": "playbook", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| }, | |
| { | |
| "Instruction": "Threat model the scenario and identify defensive controls. Focus on security logging in foundational security reasoning.", | |
| "Input": "An organization is improving its foundational security reasoning program and wants training guidance on security logging. The guidance must be suitable for authorized security work, model fine-tuning, and analyst education.", | |
| "Output": "## Summary\nsecurity logging matters because it affects how defenders prevent, detect, prioritize, or respond to security risk in foundational security reasoning. A useful assistant should explain the idea, connect it to operational decisions, and avoid turning the answer into an abuse procedure.\n\n## Practical guidance\n1. Define the asset, user, data, or workflow affected by security logging.\n2. Identify the business impact, likely threat actors, common failure modes, and existing controls.\n3. Prefer measurable defensive actions: inventory, configuration review, logging, alerting, access control, patching, segmentation, backup, and recovery validation.\n4. Document assumptions, evidence, risk rating, owner, remediation plan, and review date.\n5. Validate the control in a lab, staging environment, tabletop exercise, or approved assessment before relying on it in production.\n\n## Training answer characteristics\n- Be specific enough for an analyst to act defensively.\n- Distinguish confirmed evidence from hypotheses.\n- Include escalation criteria and safe handoff points.\n- Reference frameworks such as NIST CSF, CIS Controls, OWASP, MITRE ATT&CK, or ISO 27001 when relevant.\n- Avoid instructions that enable unauthorized access, stealth, credential theft, malware deployment, or destructive activity.\n\n## Example safe response\nFor security logging, start by confirming scope and authorization, gather relevant logs or configuration evidence, compare findings against policy and known-good baselines, prioritize by exposure and impact, then recommend remediation with verification steps.", | |
| "Metadata": { | |
| "domain": "core-security-concepts", | |
| "subdomain": "security logging", | |
| "difficulty": "advanced", | |
| "task_type": "threat_model", | |
| "safety_level": "authorized_defensive_educational", | |
| "intended_use": "fine-tuning cybersecurity assistants" | |
| } | |
| } | |
| ] |
Xet Storage Details
- Size:
- 11.6 kB
- Xet hash:
- 55136163af865576b3258d442a74578d20d7b3aa7e08d3605d701723fb6c50ec
·
Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.