Escaping host dataset and other Linux dataset

datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/cisco_isovalent.yml

@@ -0,0 +1,14 @@
+author: Bhavin Patel, Splunk
+id: b5484a09-fc58-4817-9d42-cdbb2691147b
+date: '2025-10-01'
+description: |
+ Generated datasets for Cisco Isovalent Process Exec EventType. Contains simulations for the escaping from host.
+environment: manual simulations in a K8s cluster running Tetragon
+directory: cisco_isovalent_k8_escape
+mitre_technique:
+- T1611
+datasets:
+- name: cisco_isovalent
+  path: /datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/cisco_isovalent.log
+  sourcetype: cisco:isovalent
+  source: cisco_isovalent

datasets/cisco_isovalent/cisco_isovalent.yml

@@ -2,10 +2,9 @@ author: Bhavin Patel, Splunk
 id: 1fc537db-5e0b-4a2e-a768-27e08eff0c70
 date: '2025-08-15'
 description: |
- Generated datasets for Cisco Isovalent Process Exec EventType. Contains simulations for the following detections:
-  * Cisco Isovalent - Detect Shell Execution
-  * Cisco Isovalent - Curl Execution With Insecure Flags
+ Generated datasets for Cisco Isovalent Process Exec EventType by manual /atomic-red team simulations in a K8s cluster running Tetragon
 environment: manual simulations in a K8s cluster running Tetragon
+directory: cisco_isovalent
 mitre_technique: []
 datasets:
 - name: cisco_isovalent
@@ -15,4 +14,8 @@ datasets:
 - name: delayed_shell
   path: /datasets/cisco_isovalent/cisco_isovalent_process_exec_delayed_shell.log
   sourcetype: cisco:isovalent:processExec
+  source: cisco_isovalent
+- name: kprobe_spike
+  path: /datasets/cisco_isovalent/kprobe_spike.log
+  sourcetype: cisco:isovalent
   source: cisco_isovalent