The Data
Windows process behavior, one record per executable name: how often it runs, what launches it and what it launches, where it runs from, its hashes, and written guidance. Built from over 300 million real process executions, growing every day. Names seen too rarely to aggregate are pruned. The same tables serve the API, the MCP tools, the free pages, and the dataset export.
Where the data comes from
In the wild
Production endpoint telemetry from many organizations, aggregated per executable into prevalence, ancestry, paths, and hashes. No per-endpoint, per-user, or per-organization identifiers survive aggregation.
In the lab
Our own lab installs and runs software on current Windows builds and measures how it behaves: command lines, DLL loads, network, DNS, registry and file writes, persistence. It runs continuously, with new sensors and hosts added over time.
The dataset grows every day from both.
Tables and fields
| Table | Fields | Rows |
|---|---|---|
| processes | One row per executable name: total executions, rank, description, category, publisher, LOLBin flag, risk level | 40,000+ |
| parents | Parent process, child process, execution count, share of the child's executions | 90,000+ |
| grandparents | Grandparent, parent, child triples with counts | 40,000+ |
| paths | Executable name, directory, count, share | 80,000+ |
| hashes | SHA256 (with MD5 where known), executable name, count, share | 90,000+ |
| intel | Normal behavior, suspicious indicators, abuse patterns, detection guidance, false-positive notes, MITRE ATT&CK techniques, references, per process | per process |
| lab_* | Lab observations, one table each: command lines, DLL loads, network, DNS, registry and file writes, autoruns, persistence, signer, hashes, each row labeled by Windows build and date | 50+ executables |
What's not in it
- Raw events. Nothing per endpoint, per organization, per user, or per timestamp.
- The knowledge corpus (Sigma, LOLBAS, ATT&CK, Atomic, KEV). Those are public and refresh weekly on the API.
Coverage
What a lookup can hit. Counts are rows in the lookup tables, not raw events. A miss on the API is queued, and POST /v1/notify registers your interest in the name.
- Processes
- 40,000+
- distinct executable names with a behavior record, and growing
- Hashes
- 90,000+
- SHA256 values tied to a process name and count, and growing
- Parent-child pairs
- 90,000+
- distinct parent to child relationships with counts, and growing
- Grandparent rows
- 40,000+
- grandparent, parent, child triples, and growing
- Path rows
- 80,000+
- process to directory observations, and growing
- Free pages
- 2,500+
- executables published as free reference pages, a subset of the data, and growing
Free pages, full dataset. Every one of the 40,000+ executables has a behavior record reachable by API. A subset is published as free reference pages, growing every day.
Read it on the free pages, query it over the API, or take the whole thing under the dataset license.