splunk · patel-bhavin · Nov 21, 2025 · Nov 21, 2025 · Nov 21, 2025
diff --git a/datasets/suspicious_behaviour/local_llms/4688_local_llms.log b/datasets/suspicious_behaviour/local_llms/4688_local_llms.log
diff --git a/datasets/suspicious_behaviour/local_llms/4688_local_llms.txt b/datasets/suspicious_behaviour/local_llms/4688_local_llms.txt
diff --git a/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml b/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml
@@ -7,11 +7,14 @@ directory: local_llms
 mitre_technique: []
 datasets:
 - name: sysmon_local_llms
-  path: /datasets/local_llms/sysmon_local_llms.txt
-  source: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/local_llms/sysmon_local_llms.txt
-  sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  path: /datasets/suspicious_behaviour/local_llms/sysmon_local_llms.log
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: XmlWinEventLog
 - name: 4688_local_llms
-  path: /datasets/local_llms/4688_local_llms.txt
-  source: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/local_llms/4688_local_llms.txt
-  sourcetype: XmlWinEventLog:Security
-
+  path: /datasets/suspicious_behaviour/local_llms/4688_local_llms.log
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: XmlWinEventLog
+- name: sysmon_dns
+  path: /datasets/suspicious_behaviour/local_llms/sysmon_dns.log
+  source: XmlWinEventLog:Security
+  sourcetype: XmlWinEventLog
diff --git a/datasets/suspicious_behaviour/local_llms/sysmon_dns.log b/datasets/suspicious_behaviour/local_llms/sysmon_dns.log
diff --git a/datasets/suspicious_behaviour/local_llms/sysmon_local_llms.log b/datasets/suspicious_behaviour/local_llms/sysmon_local_llms.log