IoT Device Security Incident Log

This dataset provides a detailed log of security incidents reported by IoT devices, including device identifiers, incident types, severity levels, response actions, and compliance flags. It enables organizations to monitor threat trends, analyze device vulnerabilities, and assess incident response effectiveness for regulatory and operational security management.

  • last updated 21 Dec 2025
  • by GoMask
The brief that made it

Monitoring and analyzing security incident trends across IoT infrastructure

Sample rows

preview · 8 of 150 rows · all 17 columns
incident_idstringdetected_bystringresponse_time_minutesfloatresolvedbooleandevice_idstringdevice_typestringdevice_locationstringincident_datetimedatetimereported_datetimedatetimeincident_typestringseverity_levelstringresponse_actionstringresponse_datetimedatetimeresolution_datetimedatetimecompliance_flagbooleanreporting_user_idstringincident_descriptionstring
INC-0001automated_alert3.1trueDEV-1001-AcameraHQ_Floor1_Room2012024-01-03T23:59:59Z2024-01-04T00:01:03Zunauthorized_accesscriticaldevice_isolated2024-01-04T00:03:05Z2024-01-04T00:22:12ZtrueSYS-SECUnauthorized access detected by camera in HQ. Multiple failed login attempts followed by successful breach.
INC-0002automated_alert5.3trueDEV-1450-ZsensorBuildingA_Lab52024-01-10T08:17:46Z2024-01-10T08:18:02Zmalware_detectedhighfirmware_updated2024-01-10T08:23:19Z2024-01-10T08:39:50ZtrueSYS-SECSensor firmware flagged suspicious process. Malware signature matched during scheduled scan.
INC-0003automated_alert1.8trueDEV-212Xsmart_lockWarehouse_Entry22024-01-13T13:05:00Z2024-01-13T13:06:20Zdenial_of_servicecriticaldevice_isolated2024-01-13T13:08:09Z2024-01-13T14:01:42ZtrueblankSmart lock became unresponsive after multiple high-frequency access attempts. Possible DoS attack.
INC-0004external_report33.9falseDEV-BETA-003gatewayEdgeNet_Node52024-01-14T16:12:27Z2024-01-14T16:13:29Zdata_exfiltrationcriticaldevice_isolated2024-01-14T16:47:20ZblankfalseSYS-NOCLarge data transfer detected from gateway node to external IP. Possible exfiltration attempt.
INC-0005manual_review9.2trueDEV-88888window_sensorGreenhouse_SectionB2024-01-19T12:00:00Z2024-01-19T12:01:10Zconfiguration_changemediumsettings_reverted2024-01-19T12:10:14Z2024-01-19T12:25:47ZtrueUSR-257Window sensor configuration altered remotely. Change confirmed by manual review.
INC-0006manual_review11.8trueDEV-700-Lhumidity_sensorWarehouse_Rack32024-01-22T09:44:10Z2024-01-22T09:44:45Zotherlowno_action_required2024-01-22T09:56:00Z2024-01-22T10:15:00ZtrueUSR-198Humidity sensor reported unexpected values. Manual inspection found no fault.
INC-0007manual_review16trueDEV-LG-7environment_sensorHQ_Floor2_Room2052024-01-24T17:00:00Z2024-01-24T17:02:00Zconfiguration_changemediumsettings_reverted2024-01-24T17:18:00Z2024-01-24T17:33:00ZtrueUSR-324Unauthorized configuration change detected on environment sensor. Settings reverted.
INC-0008automated_alert6.4trueDEV-AC-999air_quality_monitorDataCenter_RoomA2024-01-27T01:00:00Z2024-01-27T01:01:10Zmalware_detectedhighdevice_restarted2024-01-27T01:07:22Z2024-01-27T01:29:15ZtrueblankAir quality monitor flagged malware during scheduled scan. Network anomaly detected.

What the 150 rows show

from the 150-row sample

External_report (detected by) stands out: mean response_time_minutes is 30.1, against 4.9 for the rest.

  • 82%resolved = true
  • 4.8median response_time_minutes
  • 4severity levels
  • 6incident types
  • 8response actions
  • 10device types
Mean response_time_minutes by detected_by150 rows
020403.5automated_al…67 rows6.6manual_review56 rows30.1external_rep…27 rows
response_time_minutes150 rows, in bands of 10
06012011812762400105090response_time_minutes →

Median 4.8, from 1.3 to 87.6.

device_id150 rows · top 10 of 11 values
  1. DEV-BETA-00319
  2. DEV-1450-Z18
  3. DEV-AC-99918
  4. DEV-8888817
  5. DEV-LG-717
  6. DEV-1001-A16
  7. DEV-XYZ-2213
  8. DEV-212X12
  9. DEV-700-L8
  10. DEV-XS-2116
17 columns by typefrom the column list below
  • string 10
  • float 1
  • datetime 4
  • boolean 2

Columns

17 columns in four groups
blueprint · 17 columns
columntypedescriptionexample
Text 10 columns
incident_idstringUnique identifier for each security incidentuniqueINC-0001
device_idstringUnique identifier for the IoT device reporting the incident11 devicesDEV-1001-A
device_typestringType or category of the IoT device (e.g., sensor, camera, thermostat)10 typescamera
device_locationstringPhysical or logical location of the device (e.g., building, room, network segment)optionalHQ_Floor1_Room201
incident_typestringClassification of the security incident (e.g., unauthorized access, malware detected, data exfiltration)6 valuesunauthorized_access
severity_levelstringSeverity rating of the incident (e.g., low, medium, high, critical)low · medium · high · criticalcritical
incident_descriptionstringDetailed description of the incident, including observed symptoms and contextoptionalUnauthorized access detec…
detected_bystringMethod or system that detected the incident (e.g., automated alert, manual review, external report)3 values · optionalautomated_alert
response_actionstringPrimary action taken in response to the incident (e.g., device isolated, firmware updated, alert escalated)8 actions · optionaldevice_isolated
reporting_user_idstringIdentifier for the user or system that reported the incidentoptionalSYS-SEC
Numbers 1 column
response_time_minutesfloatTime in minutes between incident detection and first response action0 or more · optional3.1
Dates and times 4 columns
incident_datetimedatetimeTimestamp when the security incident occurred or was detected2024-01-03T23:59:59Z
reported_datetimedatetimeTimestamp when the incident was reported to the monitoring system2024-01-04T00:01:03Z
response_datetimedatetimeTimestamp when the first response action was initiatedoptional2024-01-04T00:03:05Z
resolution_datetimedatetimeTimestamp when the incident was marked as resolvedoptional2024-01-04T00:22:12Z
True or false 2 columns
resolvedbooleanIndicates whether the incident has been fully resolvedtrue
compliance_flagbooleanIndicates if the incident was handled according to regulatory or organizational compliance standardsoptionaltrue

Use it for

  • resolved82%123 of 150 rowsmean response time mi…3.5automa…6.6manual…30.1extern…

    A technology dashboard

    The resolved rate, response_time_minutes by detected_by and a breakdown of device_id. Excel, Power BI or Tableau.

  • Why do the 27 external_report rows have a mean response_time_minutes of 30.1?

    A root-cause class exercise

    Hand out the rows and one question. The answer is in the data, not in the brief.

  • A software demo

    Believable incidents with device_id, device_type and device_location to fill a screen in front of a buyer.

Not quite right?

Make it yours.

Same 17 columns, your size and your rules. See 20 rows before you pay.

Preview 20 rows free

1,000 rows: $1.99 · 10,000: $12.99One-time. No subscription. All prices

This dataset150 rows17 columns
Yours1,000 rows17 columnsdevice_location: UK only

blueprint · iot-device-security-incident-log

Behind this dataset

Same schema. As many rows as you need.

These 150 rows came out of a blueprint — 17 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.

Rules it was built with
  • Each row represents a unique security incident from a registered IoT device.
  • Incident severity is categorized as Low, Medium, or High.
  • Include device type, location (generalized: facility or sector, not geo), event timestamp, and resolution status.
  • Devices must be assigned to an operational domain (e.g., HVAC, access control, lighting, sensors).
  • Resolution time must be tracked in hours and flagged if over 24h.
  • Compliance check result (Pass/Fail) assigned to each incident.
Rows
Open the blueprint in Data Factory

1 credit per row. Preview 20 rows free. Buy rows for the full run.

Exports
CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
Licence
yours to use, including commercially
API slug
iot-device-security-incident-log

More in Technology

Browse all
Also in TechnologyEdge Device Vulnerability Remediation LogTech Support Ticket AnalyticsPublic Wi-Fi Usage LogsAll 1,966 datasets

What should your data show?

Preview 20 rows free
No signup. No card.