Upload README.md with huggingface_hub

README.md

@@ -60,14 +60,14 @@ Built for [RhythmAI](https://github.com/SyedCode01) -- an AI-powered SOC platfor
 
 ## Training Data
 
-Fine-tuned on **9,702 curated cybersecurity examples** from public datasets, filtered for SOC/SIEM relevance:
+Fine-tuned on **9,702 curated cybersecurity examples** sourced from **137,122 raw examples** across 4 public datasets, aggressively filtered for SOC/SIEM relevance (7.1% acceptance rate):
 
-| Source | Original Size | After Filtering | Description |
-|--------|--------------|-----------------|-------------|
+| Source | Raw Size | After Filtering | Description |
+|--------|----------|-----------------|-------------|
 | [Fenrir v2.0](https://huggingface.co/datasets/AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.0) | 83,920 | ~5,000 | General cybersecurity Q&A |
 | [Trendyol Cybersecurity](https://huggingface.co/datasets/Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset) | 53,202 | ~5,000 | Instruction-tuned cybersecurity |
 
-**Filtering criteria**: Keyword relevance scoring (minimum 2 matches from 60+ SOC-relevant terms including SIEM, MITRE ATT&CK, incident response, threat detection, log analysis, etc.), response length between 50-15,000 characters, MD5-based deduplication.
+**Filtering pipeline**: Keyword relevance scoring (minimum 2 matches from 60+ SOC-relevant terms), response length between 50-15,000 characters, MD5-based deduplication. Average response length: **2,627 characters (~656 tokens)**.
 
 **Split**: 9,217 train (95%) / 485 validation (5%)
 
@@ -76,6 +76,84 @@ Fine-tuned on **9,702 curated cybersecurity examples** from public datasets, fil
 {"messages": [{"role": "system", "content": "..."}, {"role": "user", "content": "..."}, {"role": "assistant", "content": "..."}]}
 ```
 
+### Cybersecurity Content Breakdown
+
+#### MITRE ATT&CK Coverage
+
+The training data references **424 unique MITRE ATT&CK technique IDs** across all 14 tactics:
+
+| Tactic | Examples | Coverage |
+|--------|----------|----------|
+| Execution | 3,004 | 31.0% |
+| Lateral Movement | 2,427 | 25.0% |
+| Impact | 1,949 | 20.1% |
+| Privilege Escalation | 1,637 | 16.9% |
+| Persistence | 1,568 | 16.2% |
+| Exfiltration | 1,425 | 14.7% |
+| Defense Evasion | 1,277 | 13.2% |
+| Collection | 1,080 | 11.1% |
+| Reconnaissance | 900 | 9.3% |
+| Discovery | 889 | 9.2% |
+| Initial Access | 807 | 8.3% |
+| Command and Control | 208 | 2.1% |
+| Credential Access | 169 | 1.7% |
+| Resource Development | 12 | 0.1% |
+
+**Most referenced techniques**: T1078 (Valid Accounts, 1,451 examples), T1055 (Process Injection, 1,120), T1021 (Remote Services, 582), T1071 (Application Layer Protocol, 541), T1027 (Obfuscated Files, 378), T1566 (Phishing, 378), T1059 (Command and Scripting Interpreter, 376), T1562 (Impair Defenses, 339), T1203 (Exploitation for Client Execution, 323), T1041 (Exfiltration Over C2, 322).
+
+#### Attack Types & Threat Categories
+
+| Attack Type | Examples | Coverage |
+|-------------|----------|----------|
+| Phishing & Social Engineering | 9,546 | 98.4% |
+| Remote Code Execution | 5,620 | 57.9% |
+| Lateral Movement | 2,427 | 25.0% |
+| Privilege Escalation | 1,637 | 16.9% |
+| PowerShell-based Attacks | 731 | 7.5% |
+| Supply Chain Attacks | 653 | 6.7% |
+| Credential Dumping (Mimikatz/LSASS) | 393 | 4.1% |
+| Insider Threats | 376 | 3.9% |
+| Zero-Day Exploits | 375 | 3.9% |
+| Man-in-the-Middle | 294 | 3.0% |
+| Brute Force / Credential Stuffing | 264 | 2.7% |
+| C2 Communication | 228 | 2.4% |
+| DDoS / Denial of Service | 217 | 2.2% |
+| Backdoors | 203 | 2.1% |
+| Rootkits | 180 | 1.9% |
+| SQL Injection | 177 | 1.8% |
+| Buffer Overflow | 144 | 1.5% |
+| Cross-Site Scripting (XSS) | 127 | 1.3% |
+| Fileless Malware | 116 | 1.2% |
+| Living Off The Land (LOLBins) | 80 | 0.8% |
+| DNS Tunneling | 57 | 0.6% |
+
+#### Log Source & SIEM Knowledge
+
+| Log Type | Examples | Coverage |
+|----------|----------|----------|
+| Windows Event Logs (Event IDs) | 977 | 10.1% |
+| Network Flow (NetFlow/PCAP) | 410 | 4.2% |
+| IDS/IPS Alerts | 364 | 3.8% |
+| Authentication Logs | 289 | 3.0% |
+| Firewall Logs | 150 | 1.5% |
+| DNS Logs | 123 | 1.3% |
+| Syslog | 112 | 1.2% |
+
+**Security platforms referenced**: Nmap (214), YARA rules (158), Microsoft Sentinel (120), Elastic/ELK (107), Wireshark (104), Splunk (70), Metasploit (65), Sigma rules (50), Snort/Suricata (45).
+
+#### Compliance & Regulatory Frameworks
+
+| Framework | Examples | Coverage |
+|-----------|----------|----------|
+| NIST (CSF/SP 800-series) | 9,620 | 99.2% |
+| GDPR | 411 | 4.2% |
+| HIPAA | 310 | 3.2% |
+| OWASP | 304 | 3.1% |
+| PCI-DSS | 152 | 1.6% |
+| CIS Controls | 66 | 0.7% |
+| ISO 27001 | 57 | 0.6% |
+| SOC 2 | 35 | 0.4% |
+
 ## Training Details
 
 | Parameter | Value |