Datasets
The lab publishes sanitized attack-telemetry corpora (Mordor-style), each archived to Zenodo with a citable DOI. All datasets are CC-BY-4.0. Nothing is released until the sanitization review below is complete.
Planned collections
| Collection | Contents | Status |
|---|---|---|
a2a-honeypot-2026-11 |
First A2A/Poppy honeypot corpus: agent-card requests, Poppy discovery, task envelopes, and session-token traffic observed at the lab's undisclosed live honeypot endpoint. | COLLECTING |
| Monthly Poppy adoption scans | Monthly enumeration of poppy.json and agent.json deployment across tracked domains, with validity checks. |
PLANNED |
| Agent-range baseline | Reference telemetry from the lab's adversarial-emulation range: AI-agent TTP procedures vs. behavioral Sigma rules. | PLANNED |
Sanitization policy
- Honeypot logs may contain data sent by third parties; raw logs are never published.
- Source IPs are truncated, timestamps quantized, and any payload bodies reviewed before release.
- Scan corpora contain only data the lab requested from public endpoints; no third-party content beyond protocol artifacts is retained.
- Each release ships a sanitization statement describing what was removed.
Licensing: all datasets are CC-BY-4.0; cite the Zenodo DOI when using them. Releases are archived to Zenodo for permanence and versioned by collection month.