The datasets were collected by operating the testbed (simulation of small-scale of IEC 61850-compliant SASs) under four types of behaviours: 1) normal operation when no unusual events happen; 2) emergency operation when non-malicious events (e.g., short-circuit faults) happen; 3) an attack under normal operation to disrupt energy transmission; and 4) an attack under emergency operation to stop protection mechanisms or trigger undesirable protection operations.