Every week someone asks us on Discord the same question: where can I get a labelled intrusion-detection dataset that actually looks like the internet, not a lab? Today the answer stops being "you can't." We just published hookprobe/edge-ids-threats — 627,853 verdicts produced by our production edge IDS, labelled by the SENTINEL ensemble, enriched with country and ASN, and free for academic or commercial use under CC-BY-4.0. Why another IDS dataset The canonical datasets the field trains on — CICIDS2017 , UNSW-NB15 , Kitsune — are invaluable but synthetic. They were captured in controlled testbeds with injected attacks. Models trained on them tend to generalise poorly when deployed on the open internet, where attacker behaviour is noisier, ASN distribution is skewed by bulletproof hosting, and benign traffic is dominated by CDN edges and scanner services with legitimate intent. HookProbe runs on a Raspberry Pi 5 connected directly to the public internet.…