Municipal IoT Security Incident Log
This dataset logs security incidents affecting municipal IoT devices in public spaces, capturing detailed information on device type, location, incident category, severity, response actions, and outcomes. It enables government teams to monitor vulnerabilities, assess risks, and optimize the security and resilience of smart city infrastructure. The dataset supports incident trend analysis, rapid response coordination, and strategic device management.
Sample rows
preview · 8 of 65 rows · all 19 columns| incident_idstring | incident_severitystring | time_to_response_minutesinteger | data_compromisedboolean | device_idstring | device_typestring | device_location_latitudefloat | device_location_longitudefloat | device_location_descriptionstring | incident_datetimedatetime | incident_typestring | incident_statusstring | reported_bystring | response_actionstring | vulnerability_referencestring | affected_servicesstring | resolution_datetimedatetime | incident_descriptionstring | resolution_summarystring |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| INC-8HZ1LKVQ | high | 23 | true | DEV-TRAFF-001 | traffic_sensor | 40.7128 | -74.006 | Broadway & Chambers St | 2024-04-03T08:22:00 | unauthorized_access | resolved | OpsTeamNYC | Device isolated, credentials reset | CVE-2023-11456 | traffic control | 2024-04-03T09:17:00 | Unauthorized credentials used; traffic flow data accessed. | Credentials revoked and device firmware updated |
| INC-9WE2JKLT | critical | 7 | true | DEV-CAM-003 | surveillance_camera | 40.7306 | -73.9866 | Astor Pl & Lafayette | 2024-04-10T11:05:00 | data_breach | investigating | SecurityBot | Alert sent to SOC | CVE-2024-02856 | public safety | blank | Video footage containing personally identifiable information was accessed by unauthorized party. | blank |
| INC-2KJ4GBNT | medium | blank | false | DEV-ENV-009 | environmental_monitor | 40.7484 | -73.9857 | 5th Ave & 34th St | 2024-03-30T14:30:00 | malware | open | IoTManager | blank | blank | air quality monitoring | blank | Suspicious process detected on sensor firmware. | blank |
| INC-B5L2VHMZ | high | 15 | false | DEV-WIFI-004 | public_wifi_router | 40.7624 | -73.9738 | Central Park S & 6th Ave | 2024-04-02T13:12:00 | denial_of_service | closed | NetMonSys | Traffic filtered, router rebooted | blank | public Wi-Fi | 2024-04-02T14:01:00 | High volume of requests caused service unavailability. | Router rebooted and traffic filters applied |
| INC-D0G8YQSF | medium | 34 | false | DEV-CAM-003 | surveillance_camera | 40.7306 | -73.9866 | Astor Pl & Lafayette | 2024-04-12T19:47:00 | device_tampering | resolved | PatrolUnit3 | Physical inspection, casing replaced | blank | public safety | 2024-04-12T21:10:00 | Camera casing found open; no data loss detected. | Tampered casing replaced, device reconnected |
| INC-1TQ9NCMW | low | 5 | false | DEV-ENV-004 | environmental_monitor | 40.7549 | -73.984 | 7th Ave & 42nd St | 2024-04-05T15:19:00 | configuration_error | false_positive | SensorOps | Configuration reviewed | blank | air quality monitoring | blank | Sensor misconfigured; readings temporarily inaccurate. | blank |
| INC-7KX3BHTR | medium | 12 | false | DEV-TRAFF-005 | traffic_sensor | 40.7451 | -73.9986 | W 23rd St & 8th Ave | 2024-03-28T09:46:00 | unauthorized_access | investigating | OpsTeamNYC | Credentials flagged | CVE-2022-7612 | traffic control | blank | Multiple failed login attempts detected. | blank |
| INC-R1Z6DJKU | high | 21 | false | DEV-CAM-007 | surveillance_camera | 40.7587 | -73.9787 | Times Sq & 42nd St | 2024-04-07T21:34:00 | malware | resolved | SecurityBot | Device isolated, malware removed | CVE-2024-04321 | public safety | 2024-04-07T22:08:00 | Malware signature matched on camera system. | Malware removed and device monitored |
| INC-L8F3VQTP | medium | 8 | false | DEV-WIFI-009 | public_wifi_router | 40.7323 | -73.9985 | Washington Sq Park S | 2024-03-31T16:55:00 | denial_of_service | investigating | NetMonSys | Traffic analyzed | blank | public Wi-Fi | blank | Unusual spike in network traffic detected. | blank |
| INC-0JZ6NHWV | low | blank | false | DEV-ENV-004 | environmental_monitor | 40.7549 | -73.984 | 7th Ave & 42nd St | 2024-04-08T10:11:00 | other | open | SensorOps | blank | blank | noise monitoring | blank | Sensor reported unexpected low battery alert. | blank |
| INC-H4Z2CVWM | medium | 19 | false | DEV-TRAFF-002 | traffic_sensor | 40.7209 | -74.0007 | Canal St & Varick St | 2024-04-09T17:54:00 | configuration_error | resolved | IoTManager | Configuration updated | blank | traffic control | 2024-04-09T18:30:00 | Device misconfigured; traffic data not transmitted. | Configuration corrected and device rebooted |
| INC-X9K2BTRQ | high | blank | false | DEV-CAM-011 | surveillance_camera | 40.7357 | -73.9912 | Union Sq E & 14th St | 2024-04-02T06:40:00 | device_tampering | open | PatrolUnit2 | blank | blank | public safety | blank | Camera alignment altered, possible tampering. | blank |
| INC-F2V6JQNM | critical | 11 | false | DEV-WIFI-004 | public_wifi_router | 40.7624 | -73.9738 | Central Park S & 6th Ave | 2024-04-06T08:08:00 | malware | investigating | SecurityBot | Device isolated | CVE-2023-99871 | public Wi-Fi | blank | Malicious code detected on router. | blank |
| INC-6YJ8NLVR | high | 17 | true | DEV-TRAFF-008 | traffic_sensor | 40.7608 | -73.9759 | Madison Ave & E 59th St | 2024-04-04T17:45:00 | unauthorized_access | resolved | OpsTeamNYC | Device isolated, passwords reset | CVE-2023-77165 | traffic control | 2024-04-04T18:13:00 | User credentials compromised; route data exported. | Password reset and device monitored |
| INC-W7K2ZTVJ | low | 6 | false | DEV-ENV-009 | environmental_monitor | 40.7484 | -73.9857 | 5th Ave & 34th St | 2024-04-11T17:22:00 | other | closed | SensorOps | Battery replaced | blank | air quality monitoring | 2024-04-11T17:37:00 | Battery depleted; device offline briefly. | Device battery replaced and restored |
| INC-G4M9LJWP | medium | 13 | false | DEV-WIFI-009 | public_wifi_router | 40.7323 | -73.9985 | Washington Sq Park S | 2024-04-10T12:40:00 | configuration_error | resolved | NetMonSys | Configuration updated | blank | public Wi-Fi | 2024-04-10T13:07:00 | Router misconfigured, intermittent connectivity. | Configuration corrected and router rebooted |
| INC-P6F2KJWV | critical | blank | true | DEV-CAM-011 | surveillance_camera | 40.7357 | -73.9912 | Union Sq E & 14th St | 2024-03-27T21:09:00 | data_breach | open | SecurityBot | blank | CVE-2024-03998 | public safety | blank | Camera feed with facial data accessed by unauthorized party. | blank |
| INC-V1C6KJRT | high | 27 | false | DEV-ENV-004 | environmental_monitor | 40.7549 | -73.984 | 7th Ave & 42nd St | 2024-04-13T16:37:00 | malware | resolved | IoTManager | Firmware updated | CVE-2022-55341 | air quality monitoring | 2024-04-13T17:04:00 | Malware detected on sensor, blocked data transmission. | Firmware updated and sensor monitored |
| INC-K7Z2LJHT | medium | 10 | false | DEV-TRAFF-002 | traffic_sensor | 40.7209 | -74.0007 | Canal St & Varick St | 2024-04-02T10:33:00 | denial_of_service | closed | OpsTeamNYC | Traffic filtered | blank | traffic control | 2024-04-02T11:04:00 | High volume traffic caused sensor lag. | Traffic filtered and device rebooted |
| INC-5TQ3KHNM | critical | 42 | false | DEV-CAM-007 | surveillance_camera | 40.7587 | -73.9787 | Times Sq & 42nd St | 2024-03-29T22:21:00 | device_tampering | resolved | PatrolUnit3 | Camera replaced | blank | public safety | 2024-03-29T23:18:00 | Camera lens cracked; device replaced. | Device replaced and incident closed |
What the 65 rows show
from the 65-row sampleHigh (incident severity) stands out: 11 of its 18 rows have data_
- 29%data_
compromised = true - 20median time_
to_ response_ minutes - 5incident statuses
- 7incident types
- 8device types
- 12affected serviceses
Median 20, from 4 to 67.
- string 13
- integer 1
- float 2
- datetime 2
- boolean 1
Columns
19 columns in four groups| column | type | description | example |
|---|---|---|---|
| Text 13 columns | |||
incident_id | string | Unique identifier for each security incidentunique | INC-8HZ1LKVQ |
device_id | string | Unique identifier for the IoT device involved in the incident | DEV-TRAFF-001 |
device_type | string | Type or category of IoT device (e.g., traffic sensor, surveillance camera, environmental monitor)8 types | traffic_sensor |
device_location_description | string | Human-readable description of the device's location (e.g., 'Main St & 3rd Ave')optional | Broadway & Chambers St |
incident_type | string | Categorization of the security incident (e.g., unauthorized access, malware, data breach, device tampering)7 values | unauthorized_access |
incident_severity | string | Severity level of the incident (e.g., low, medium, high, critical)low · medium · high · critical | high |
incident_status | string | Current status of the incident (e.g., open, investigating, resolved, closed, false positive)open · investigating · resolved · closed · false_positive | resolved |
reported_by | string | Name or identifier of the person, team, or system that reported the incidentoptional | OpsTeamNYC |
response_action | string | Summary of actions taken in response to the incident (e.g., device isolated, firmware updated, alert sent)optional | Alert sent to SOC |
vulnerability_reference | string | Reference to known vulnerability (e.g., CVE identifier) if applicableoptional | CVE-2023-11456 |
affected_services | string | Comma-separated list of city services or systems affected by the incident (e.g., traffic control, public Wi-Fi)12 serviceses · optional | traffic control |
incident_description | string | Detailed narrative describing the incident, impact, and contextoptional | Unauthorized credentials … |
resolution_summary | string | Summary of how the incident was resolved or mitigatedoptional | Credentials revoked and d… |
| Numbers 3 columns | |||
device_location_latitude | float | Latitude coordinate of the device's physical location-90 to 90 | 40.7128 |
device_location_longitude | float | Longitude coordinate of the device's physical location-180 to 180 | -74.006 |
time_to_response_minutes | integer | Number of minutes between incident detection and initial response action0 or more · optional | 23 |
| Dates and times 2 columns | |||
incident_datetime | datetime | Date and time when the incident was detected or reported | 2024-04-03T08:22:00 |
resolution_datetime | datetime | Date and time when the incident was resolved or closedoptional | 2024-04-03T09:17:00 |
| True or false 1 column | |||
data_compromised | boolean | Indicates whether sensitive data was compromised in the incident | true |
Use it for
A government dashboard
The data_
compromised rate, time_ to_ response_ minutes by incident_ severity and a breakdown of device_ id. Excel, Power BI or Tableau. Why do 19 of 65 rows have data_
compromised = true? A root-cause class exercise
Hand out the rows and one question. The answer is in the data, not in the brief.
- Incidents65INC-8HZ1LKVQ23highINC-9WE2JKLT7criticalINC-2KJ4GBNTmedium
A software demo
Believable incidents with device_
id, device_ type and device_ location_ latitude to fill a screen in front of a buyer.
This dataset65 rows19 columns
Yours1,000 rows19 columnsdevice_location_latitude: UK only
blueprint · municipal-iot-security-incident-log
Behind this dataset
Same schema. As many rows as you need.
These 65 rows came out of a blueprint — 19 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.
Rules it was built with
- Each record represents a single security incident associated with one IoT device.
- Include incident type, device ID, timestamp, resolution status, and response time.
- Flag incidents involving unauthorized access separately from malware or network anomalies.
- Only include incidents that triggered an automated alert and required human review.
Open the blueprint in Data Factory
1 credit per row. Preview 20 rows free. Buy rows for the full run.
- Exports
- CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
- Licence
- yours to use, including commercially
- API slug
- municipal-iot-security-incident-log