Generate Security Sample Data

Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic Security dashboards, the Alerts tab, and Attack Discovery.

Quick start

For a zero-friction experience that generates everything and opens Kibana:

node skills/security/generate-security-sample-data/scripts/demo-walkthrough.js

Workflow

- [ ] Step 1: Set environment variables
- [ ] Step 2: Generate sample data
- [ ] Step 3: Explore in Kibana
- [ ] Step 4: Clean up when done

Step 1: Set environment variables

export ELASTICSEARCH_URL="https://your-project.es.region.aws.elastic.cloud"
export ELASTICSEARCH_USERNAME="admin"
export ELASTICSEARCH_PASSWORD="your-password"
export KIBANA_URL="https://your-project.kb.region.aws.elastic.cloud"

Step 2: Generate sample data

Generate everything at once

node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint okta aws windows --scenarios --alerts

Generate only events

node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint --count 100

Generate only attack scenarios

node skills/security/generate-security-sample-data/scripts/sample-data.js --scenarios

Generate only synthetic alerts

node skills/security/generate-security-sample-data/scripts/sample-data.js --alerts

Step 3: Explore in Kibana

After generating data, direct the user to these pages:

• Security > Alerts, synthetic alerts with MITRE ATT&CK mappings
• Security > Attack Discovery, requires an LLM connector to analyze alerts
• Security > Hosts, host activity from sample events
• Security > Overview, summary of all security data
• Discover, raw events across all data streams

Step 4: Clean up when done