security-generate-security-sample-data

Files (6)

• SKILL.md
• sample-data-reference.md · references/
• demo-walkthrough.js · scripts/
• es-client.js · scripts/
• kibana-client.js · scripts/
• sample-data.js · scripts/

SKILL.md (first lines)

# Generate Security Sample Data

Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic
Security dashboards, the Alerts tab, and Attack Discovery.

## Quick start

For a zero-friction experience that generates everything and opens Kibana:

```bash
node skills/security/generate-security-sample-data/scripts/demo-walkthrough.js
```

## Workflow

```text
- [ ] Step 1: Set environment variables
- [ ] Step 2: Generate sample data
- [ ] Step 3: Explore in Kibana
- [ ] Step 4: Clean up when done
```

### Step 1: Set environment variables

```bash
export ELASTICSEARCH_URL="https://your-project.es.region.aws.elastic.cloud"
export ELASTICSEARCH_USERNAME="admin"
export ELASTICSEARCH_PASSWORD="your-password"
export KIBANA_URL="https://your-project.kb.region.aws.elastic.cloud"
```

### Step 2: Generate sample data

#### Generate everything at once

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint okta aws windows --scenarios --alerts
```

#### Generate only events

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint --count 100
```

#### Generate only attack scenarios

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js --scenarios
```

#### Generate only synthetic alerts

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js --alerts
```

### Step 3: Explore in Kibana

After generating data, direct the user to these pages:

- **Security > Alerts** — synthetic alerts with MITRE ATT&CK mappings
- **Security > Attack Discovery** — requires an LLM connector to analyze alerts
- **Security > Hosts** — host activity from sample events
- **Security > Overview** — summary of all security data
- **Discover** — raw events across all data streams

### Step 4: Clean up when done

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js --cleanup
```

## What gets generated

Sample data spans 5 packages (system, endpoint, windows, aws, okta) and 4 focused attack scenarios covering the most
common demo themes: Windows credential theft, AWS cloud privilege escalation, Okta identity takeover, and a full
ransomware kill chain. Synthetic alert documents are indexed into `.alerts-security.alerts-default` with MITRE ATT&CK
mappings, severity levels, and risk scores.

All events use RFC 5737 / RFC 2606 safe addresses. For full tables of packages, scenarios, and alerts see
[references/sample-data-reference.md](references/sample-data-reference.md).

## Continuous mode

Stream events to simulate a live environment:

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js \
  --continuous --interval 15
```

Every 5th batch includes an attack scenario; every 10th batch adds synthetic alerts. Press Ctrl+C to stop.

## Tool reference

### sample-data.js

| Flag              | Description                                      |
| ----------------- | ------------------------------------------------ |
| `--count`, `-n`   | Events per package (default: 50)                 |
| `--scenarios`     | Run all attack simulation scenarios              |
| `--scenario NAME` | Run a specific scenario                          |
| `--alerts`        | Generate synthetic alert documents               |
| `--cleanup`       | Remove all sample data and alerts                |
| `--continuous`    | Stream live events (Ctrl+C to stop)              |
| `--interval N`    | Seconds between continuous batches (default: 30) |
| `--json`, `-j`    | Output results as JSON                           |
| `--yes`, `-y`     | Skip confirmation prompts                        |

### demo-walkthrough.js

Zero-friction runner that generates everything and opens Kibana.

| Flag           | Description                           |
| -------------- | ------------------------------------- |
| `--cleanup`    | Remove all sample data, alerts, case  |

From elastic/agent-skills, Apache-2.0.

More from elastic/agent-skills