Remote Team Cybersecurity Incident Logs
This dataset provides detailed logs of cybersecurity incidents affecting remote employees, including incident types, severity, response times, and training gaps. It enables HR and IT teams to analyze vulnerabilities, optimize incident response, and identify areas for targeted security training, supporting proactive risk management for distributed workforces.
Sample rows
preview · 8 of 75 rows · all 20 columns| incident_idstring | incident_severitystring | response_time_minutesinteger | training_gap_identifiedboolean | training_type_recommendedstring | employee_idstring | employee_departmentstring | employee_location_citystring | employee_location_statestring | employee_location_countrystring | incident_datetimedatetime | incident_typestring | vulnerability_sourcestring | response_initiated_datetimedatetime | response_completed_datetimedatetime | incident_statusstring | reported_bystring | reporting_channelstring | incident_descriptionstring | response_actionsstring |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| INC0001 | medium | 35 | true | phishing awareness | EMP1023 | IT | San Francisco | CA | USA | 2024-04-02T09:24:00 | phishing | social engineering | 2024-04-02T09:30:00 | 2024-04-02T10:05:00 | resolved | EMP1023 | Employee received an email requesting confidential login details. | Password reset, user notified, phishing email blocked. | |
| INC0002 | high | 75 | true | safe browsing | EMP1007 | HR | London | England | UK | 2024-05-16T13:42:00 | malware | unverified downloads | 2024-05-16T13:45:00 | 2024-05-16T15:00:00 | resolved | EMP1012 | helpdesk | Malware detected during file download from unknown source. | System isolated, malware removed, files quarantined. |
| INC0003 | critical | 48 | true | password management | EMP1062 | Finance | Dallas | TX | USA | 2024-03-11T16:20:00 | unauthorized_access | weak password | 2024-03-11T16:22:00 | 2024-03-11T17:10:00 | resolved | EMP1062 | chat | Unauthorized login attempt detected from foreign IP. | Forced logout, password policy updated, IP blocked. |
| INC0004 | medium | 45 | true | phishing awareness | EMP1084 | Sales | Berlin | Berlin | Germany | 2024-01-22T10:50:00 | phishing | social engineering | 2024-01-22T10:55:00 | 2024-01-22T11:40:00 | resolved | EMP1084 | Sales manager clicked on a suspicious link in a client email. | Account monitored, link flagged, user coached. | |
| INC0005 | high | 100 | false | blank | EMP1031 | IT | Toronto | Ontario | Canada | 2024-02-13T12:17:00 | malware | unpatched software | 2024-02-13T12:20:00 | 2024-02-13T14:00:00 | closed | EMP1031 | helpdesk | Ransomware detected on employee workstation. | Workstation isolated, data restored, patch deployed. |
| INC0006 | medium | 35 | true | data handling | EMP1057 | Marketing | Sydney | NSW | Australia | 2024-04-07T08:30:00 | data_leak | misconfigured permissions | 2024-04-07T08:35:00 | 2024-04-07T09:10:00 | resolved | EMP1057 | chat | Sensitive campaign data shared via public link. | Link revoked, permissions corrected, review conducted. |
| INC0007 | low | 9 | false | blank | EMP1002 | Finance | New York | NY | USA | 2024-05-05T14:00:00 | phishing | social engineering | 2024-05-05T14:01:00 | 2024-05-05T14:10:00 | resolved | EMP1002 | Phishing attempt detected; employee did not engage. | Phishing email blocked, user notified. | |
| INC0008 | high | 43 | true | password management | EMP1095 | IT | Amsterdam | North Holland | Netherlands | 2024-02-23T15:45:00 | unauthorized_access | weak password | 2024-02-23T15:47:00 | 2024-02-23T16:30:00 | closed | EMP1095 | helpdesk | Multiple failed login attempts to secure server. | Account locked, password policy enforced. |
| INC0009 | medium | 45 | true | data handling | EMP1047 | Sales | Paris | Île-de-France | France | 2024-03-28T11:40:00 | data_leak | misconfigured permissions | 2024-03-28T11:45:00 | 2024-03-28T12:30:00 | resolved | EMP1047 | Client contact data exposed due to incorrect sharing settings. | Sharing settings corrected, clients notified. | |
| INC0010 | medium | 46 | true | phishing awareness | EMP1019 | HR | Seattle | WA | USA | 2024-01-10T09:55:00 | phishing | social engineering | 2024-01-10T09:59:00 | 2024-01-10T10:45:00 | resolved | EMP1019 | helpdesk | HR assistant responded to a fake payroll query. | Account monitored, phishing email flagged. |
| INC0011 | high | 65 | true | safe browsing | EMP1028 | Marketing | Madrid | Madrid | Spain | 2024-05-18T16:00:00 | malware | unverified downloads | 2024-05-18T16:05:00 | 2024-05-18T17:10:00 | resolved | EMP1028 | chat | Malware downloaded from an unsecured website. | Device scanned, malware removed, security settings updated. |
| INC0012 | critical | 38 | true | password management | EMP1071 | Finance | Chicago | IL | USA | 2024-02-05T08:50:00 | unauthorized_access | weak password | 2024-02-05T08:52:00 | 2024-02-05T09:30:00 | closed | EMP1071 | phone | Finance administrator detected unauthorized access to payroll application. | Session terminated, credentials reset, investigation started. |
| INC0013 | low | 9 | false | blank | EMP1005 | Sales | Los Angeles | CA | USA | 2024-03-15T13:35:00 | phishing | social engineering | 2024-03-15T13:36:00 | 2024-03-15T13:45:00 | closed | EMP1005 | Suspicious email ignored by sales associate. | Email blocked, associate reminded of security protocols. | |
| INC0014 | critical | 135 | false | blank | EMP1041 | IT | Vancouver | British Columbia | Canada | 2024-04-14T11:10:00 | ransomware | unpatched software | 2024-04-14T11:15:00 | 2024-04-14T13:30:00 | closed | EMP1041 | helpdesk | System files encrypted; ransom demand received. | System restored, patch applied, user notified. |
| INC0015 | medium | 36 | true | phishing awareness | EMP1089 | Marketing | Melbourne | Victoria | Australia | 2024-05-29T09:25:00 | phishing | social engineering | 2024-05-29T09:29:00 | 2024-05-29T10:05:00 | resolved | EMP1089 | Marketing analyst provided details on a suspicious form. | Form disabled, employee coached. | |
| INC0016 | high | 38 | true | device security | EMP1015 | HR | Manchester | England | UK | 2024-02-21T16:40:00 | malware | external device | 2024-02-21T16:42:00 | 2024-02-21T17:20:00 | resolved | EMP1015 | phone | HR manager's laptop infected via USB drive. | Device scanned, malware removed, security updated. |
| INC0017 | high | 37 | true | password management | EMP1067 | Finance | Boston | MA | USA | 2024-03-02T08:15:00 | unauthorized_access | weak password | 2024-03-02T08:18:00 | 2024-03-02T08:55:00 | resolved | EMP1067 | helpdesk | Account compromised due to password reuse. | Account locked, password policy updated. |
| INC0018 | medium | 45 | true | data handling | EMP1033 | Sales | Zurich | Zurich | Switzerland | 2024-01-21T17:50:00 | data_leak | misconfigured permissions | 2024-01-21T17:55:00 | 2024-01-21T18:40:00 | resolved | EMP1033 | chat | Proposal document shared with external party. | Permissions corrected, external access revoked. |
| INC0019 | low | 20 | false | blank | EMP1052 | IT | Montreal | Quebec | Canada | 2024-04-19T10:45:00 | other | network anomaly | 2024-04-19T10:50:00 | 2024-04-19T11:10:00 | closed | EMP1052 | Unusual network traffic detected, no impact found. | Traffic monitored, logs reviewed. | |
| INC0020 | medium | 45 | true | phishing awareness | EMP1091 | Marketing | Brisbane | Queensland | Australia | 2024-05-01T12:20:00 | phishing | social engineering | 2024-05-01T12:25:00 | 2024-05-01T13:10:00 | resolved | EMP1091 | helpdesk | Staff member replied to a fake survey email. | Survey link disabled, user coached. |
What the 75 rows show
from the 75-row sampleCritical (incident severity) stands out: mean response_
- 63%training_
gap_ identified = true - 41median response_
time_ minutes - 2incident statuses
- 4reporting channels
- 6incident types
- 7employee departments
Median 41, from 4 to 138.
- string 15
- integer 1
- datetime 3
- boolean 1
Columns
20 columns in four groups| column | type | description | example |
|---|---|---|---|
| Text 15 columns | |||
incident_id | string | Unique identifier for each cybersecurity incidentunique | INC0001 |
employee_id | string | Unique identifier for the remote employee involved in the incident | EMP1023 |
employee_department | string | Department of the employee (e.g., IT, HR, Sales)7 departments | IT |
employee_location_city | string | City where the employee was located during the incidentoptional | San Francisco |
employee_location_state | string | State or region where the employee was located during the incidentoptional | CA |
employee_location_country | string | Country where the employee was located during the incidentoptional | USA |
incident_type | string | Type of cybersecurity incident (e.g., phishing, malware, unauthorized access)6 values | phishing |
incident_severity | string | Severity level of the incidentlow · medium · high · critical | medium |
incident_description | string | Detailed description of the incidentoptional | Employee received an emai… |
vulnerability_source | string | Source or cause of the vulnerability (e.g., unpatched software, weak password, social engineering)11 sources · optional | social engineering |
response_actions | string | Primary action(s) taken to resolve the incident (e.g., password reset, system isolation, patch applied)optional | Phishing email blocked. |
incident_status | string | Current status of the incidentopen · in_progress · resolved · closed | resolved |
training_type_recommended | string | Type of training recommended to address the gap (e.g., phishing awareness, password management)5 recommendeds · optional | phishing awareness |
reported_by | string | Name or identifier of the person who reported the incidentoptional | EMP1023 |
reporting_channel | string | Channel through which the incident was reported (e.g., email, helpdesk, phone)email · helpdesk · phone · chat · other · optional | |
| Numbers 1 column | |||
response_time_minutes | integer | Time taken (in minutes) to respond to the incident0 or more · optional | 35 |
| Dates and times 3 columns | |||
incident_datetime | datetime | Date and time when the incident occurred | 2024-04-02T09:24:00 |
response_initiated_datetime | datetime | Date and time when incident response was initiatedoptional | 2024-04-02T09:30:00 |
response_completed_datetime | datetime | Date and time when incident response was completedoptional | 2024-04-02T10:05:00 |
| True or false 1 column | |||
training_gap_identified | boolean | Indicates if a training gap was identified as a contributing factor | true |
Use it for
A technology dashboard
The training_
gap_ identified rate, response_ time_ minutes by incident_ severity and a breakdown of training_ type_ recommended. Excel, Power BI or Tableau. Why do the 12 critical rows have a mean response_
time_ minutes of 80.9? A root-cause class exercise
Hand out the rows and one question. The answer is in the data, not in the brief.
- Incidents75INC000135mediumINC000275highINC0005100high
A software demo
Believable incidents with employee_
id, employee_ department and employee_ location_ city to fill a screen in front of a buyer.
This dataset75 rows20 columns
Yours1,000 rows20 columnsemployee_location_city: UK only
blueprint · remote-team-cybersecurity-incident-logs
Behind this dataset
Same schema. As many rows as you need.
These 75 rows came out of a blueprint — 20 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.
Rules it was built with
- Each incident must include type, severity, and detection method.
- Only incidents reported by remote or hybrid team members are logged.
- Include incident resolution time and follow-up action status.
- Anonymize sensitive personal and company information.
- Tag incidents with related training or compliance measures.
Open the blueprint in Data Factory
1 credit per row. Preview 20 rows free. Buy rows for the full run.
- Exports
- CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
- Licence
- yours to use, including commercially
- API slug
- remote-team-cybersecurity-incident-logs