diff --git a/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed.log b/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed.log
new file mode 100755
index 00000000..abade0ac
--- /dev/null
+++ b/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c129c3c53d765e485cb2779ca607ccdbd924555a1ebae1711d55ec6205de25b0
+size 126849
diff --git a/datasets/attack_techniques/T1068/linux_dirtyfrag/linux_dirtyfrag.yml b/datasets/attack_techniques/T1068/linux_dirtyfrag/linux_dirtyfrag.yml
index d967eb3b..ccfaa183 100644
--- a/datasets/attack_techniques/T1068/linux_dirtyfrag/linux_dirtyfrag.yml
+++ b/datasets/attack_techniques/T1068/linux_dirtyfrag/linux_dirtyfrag.yml
@@ -19,4 +19,8 @@ datasets:
 -   name: linux_sysmon
     sourcetype: sysmon:linux
     source: Syslog:Linux-Sysmon/Operational
-    path: /datasets/attack_techniques/T1068/linux_dirtyfrag/linux_sysmon.log
\ No newline at end of file
+    path: /datasets/attack_techniques/T1068/linux_dirtyfrag/linux_sysmon.log
+-   name: dirty_frag_events_trimmed
+    sourcetype: auditd
+    source: auditd
+    path: /datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed.log