Built from current, refreshed internet intelligence records
Validates that grounding data is based on active internet intelligence rather than stale indicators or static training corpora.
Training and Grounding Data
Agentic AI & ML Datasets
Security AI systems need more than legacy feeds and static indicators. They need fresh, relational, provenance-aware datasets that can ground RAG, GraphRAG, tool use, fine-tuning, and agentic investigation workflows.
>742kC2 and beaconing behavior records
2.1MDark web service and user records
>85kHidden service communication records
>3.2MCredential and identity graph records
Dendrite's AI dataset offering is built around the requirements that determine whether grounding works in security: freshness, relational depth, provenance, coverage, labels, baseline context, and pre-correlation.
Structured for RAG, GraphRAG, tool use, and model evaluation
Supports retrieval, graph traversal, agent tool calls, and evaluation workflows with records designed for machine consumption.
Designed to preserve provenance across multi-hop investigations
Keeps source context, relationships, and historical evidence available as models or agents move across connected investigation paths.
What it is
Training and Grounding Data
Dendrite packages internet intelligence data for security AI systems that need current, relational, high-fidelity grounding. The offering supports inference-time grounding through RAG, GraphRAG, tool-use, and retrieval workflows, while also supporting training, tuning, and evaluation through curated security datasets, labeled behavior, and domain-specific corpora. The goal is not simply to provide more data. It is to provide the data properties that help prevent agents from treating missing evidence as proof of safety, including baseline context, historical provenance, and pre-correlated investigation depth.
Data coverage
What data it covers
- C2 and beaconing behavior records
- Dark web service and user records
- Hidden service communication records
- Credential and identity graph records
- Baseline and labeled security behavior corpora
Workflow
How it works
- Select fit-for-purpose datasets for the model or agent workflow
- Structure records, relationships, labels, and provenance for retrieval
- Ground RAG, GraphRAG, and tool-use workflows with current evidence
- Evaluate outputs against labeled behavior and auditable source context
Analyst use
How teams use it
- Ground security agents in live internet intelligence
- Train vertical models on domain-specific security behavior
- Reduce the no-known-bad-therefore-benign failure mode
Audience
Built for AI & ML Data users.
Current, relational, provenance-aware security datasets for grounding, model training, evaluation, RAG, GraphRAG, and agent workflows.
AI security teams
Ground security agents and AI workflows in current, correlated internet intelligence with provenance and baseline context.
Model builders
Train, tune, and evaluate security models with domain-specific records structured for retrieval, graph reasoning, and tool use.
Security data science teams
Use labeled behavior, historical context, and relational datasets to develop, test, and measure security-focused models.
Platform partners
Integrate Dendrite datasets into security platforms, AI products, enrichment pipelines, or managed workflows.
Features
What the capability supports.
Fresh intelligence that keeps pace with infrastructure change
Provide updated records that reflect how infrastructure, services, identities, and adversary behavior change over time.
Native graph structure for RAG, GraphRAG, and tool-use pivots
Preserve entities and relationships so retrieval systems and agents can reason across connected evidence instead of flat records.
Temporal provenance for auditability and historical reasoning
Maintain source timing, historical observations, and relationship context so model outputs can be traced and evaluated.
Labeled behavioral records for model training and evaluation
Support supervised learning, benchmark construction, and evaluation workflows with curated security behavior records.
Use cases
Operational paths for AI & ML Data.
Ground security agents in live internet intelligence
Give agents current evidence and relationship context for investigation steps that require more than static CTI lookup.
Train vertical models on domain-specific security behavior
Use curated datasets to teach models how infrastructure, credentials, dark web activity, and malicious behavior relate.
Reduce the no-known-bad-therefore-benign failure mode
Provide baseline and relational context that helps models distinguish unknown, normal, suspicious, and anomalous activity.
Data flow
Internet intelligence to grounded security AI
Dendrite packages current relational records for retrieval, training, evaluation, and agent workflows.
Dendrite packages current relational records for retrieval, training, evaluation, and agent workflows.
Input
Source data
- C2 and beaconing behavior records
- Dark web service and user records
- Hidden service communication records
- Credential and identity graph records
Processing
Correlation path
- Observe
- Correlate
- Ground
- Validate
- Refresh
Output
Analyst workflow
- Ground security agents in live internet intelligence
- Train vertical models on domain-specific security behavior
- Reduce the no-known-bad-therefore-benign failure mode
Delivery
Available where the workflow needs it.
Delivery options for AI & ML Data: Dataset export, API, Partner delivery, Custom pipelines.
Dataset export
Dataset export
- Receive curated security datasets for training, evaluation, or offline analysis
- Preserve labels, provenance, and graph relationships in customer environments
- Support model development, benchmarking, and controlled data workflows
API
API
- Retrieve grounding records and relationship context programmatically
- Support RAG, GraphRAG, tool-use, and enrichment workflows
- Refresh model context with current internet intelligence
Partner delivery
Partner delivery
- Embed Dendrite datasets into security platforms or AI products
- Support managed workflows, product integrations, and enrichment layers
- Align delivery with partner data models and customer use cases
Managed delivery
Custom pipelines
- Shape datasets around target models, domains, or evaluation tasks
- Build specialized corpora for fine-tuning, grounding, or benchmarking
- Support custom labeling, refresh cadence, and workflow integration
Related
Connected capabilities
Command & Control Intelligence
Explorator
Perpetual enumeration, fingerprinting, and monitoring of C2 infrastructure connected to malware campaigns and threat actor activity.
Cryptocurrency Data Intelligence
Cryptocurrency Data
Cryptocurrency data correlated to wallets, services, dark web activity, infrastructure, and investigation-ready entity context.
Dark Web Intelligence
Void Runner
Active collection, characterization, and correlation of dark web services, users, communication hubs, and historical records.
Identity Exposure Intelligence
Credentials
A homogenized breach and credential intelligence set correlated to infrastructure, services, users, and organizational risk context.
Operationalize
Put AI & ML Data into the workflow.
Talk with Dendrite about access, delivery options, and the right starting point for your team.