Cloud Application Events Dataset – Benign & Suspicious Samples – enUS

This synthetically generated dataset contains realistic Cloud App Events records that simulate activity logs generated by enterprise cloud services. Each record captures detailed operational and security-related metadata, including tenant IDs, user information, timestamps, source systems, activity types, resource identifiers, and contextual parameters such as IP addresses, device types, and authentication methods. The data includes both normal operational events — such as user sign-ins, file access, and configuration changes — and security-relevant events like anomalous logins, privilege escalations, and policy violations. These entries are crafted to reflect the complexity and variability found in real-world multi-tenant enterprise environments. Supports use cases such as cloud security analytics development, SOC automation, SIEM/SOAR/UEBA benchmarking, and AI-driven anomaly detection pipelines. Helps solve problems like identifying risky user activity across cloud applications, detecting policy violations before they escalate, training SOC analysts on realistic scenarios, and validating detection rules in dynamic environments. Because it is synthetically generated to mirror real-world patterns while containing no sensitive information, it is highly valuable for customers training AI/ML models for threat detection, user behavior analytics, and cloud security posture management—without the compliance risks of using production logs.