diff --git a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_corroboration.yml b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_corroboration.yml
new file mode 100644
index 000000000..1e16fd9f7
--- /dev/null
+++ b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_corroboration.yml
@@ -0,0 +1,13 @@
+author: Ahmed Hassan
+id: 98845775-b43a-4e2d-84b0-f8ba387a7e37
+date: '2026-08-18'
+description: Synthetically generated dataset pairing a classic Snort signature IntrusionEvent (GeneratorID=1) with its corroborating ConnectionEvent (Encrypted Visibility Engine telemetry) sharing the same ConnectionID, for dual-signal corroboration analytic unit tests.
+environment: manual simulations in a controlled lab environment
+directory: dual_signal_corroboration
+mitre_technique:
+- T1190
+datasets:
+- name: dual_signal_events
+  path: /datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log
+  sourcetype: cisco:sfw:estreamer
+  source: cisco:sfw:estreamer
diff --git a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log
new file mode 100644
index 000000000..2929825bb
--- /dev/null
+++ b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9e94d2868994de3277421f56535afe8743ed1ed736e6af6fd5bfde2d51f661d1
+size 2691
diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log
new file mode 100644
index 000000000..25e100082
--- /dev/null
+++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:96710c7a532a873468475f08673e1360c56c95c7ee0a5961021f60a71eda4b86
+size 3717
diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.yml b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.yml
new file mode 100644
index 000000000..27ed38360
--- /dev/null
+++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.yml
@@ -0,0 +1,13 @@
+author: Ahmed Hassan
+id: 68062594-f5df-4ac6-a928-c224a6c92c74
+date: '2026-08-18'
+description: Synthetically generated IntrusionEvent samples with GeneratorID=411 (SnortML, ML-only detection with no corroborating classic signature) for dual-signal triage tests. ML probability must not be equated to a classic Snort signature true positive.
+environment: manual simulations in a controlled lab environment
+directory: intrusion_event_snortml
+mitre_technique:
+- T1190
+datasets:
+- name: intrusion_events_snortml
+  path: /datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log
+  sourcetype: cisco:sfw:estreamer
+  source: cisco:sfw:estreamer