# Security Generate Security Sample Data

Generate sample security events, attack scenarios, and synthetic alerts for Elastic...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add elastic/agent-skills --skill security-generate-security-sample-data -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill security-generate-security-sample-data -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill security-generate-security-sample-data -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill security-generate-security-sample-data -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, or setting up a POC.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Generate Security Sample Data

Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic
Security dashboards, the Alerts tab, and Attack Discovery.

## Quick start

For a zero-friction experience that generates everything and opens Kibana:

```bash
node skills/security/generate-security-sample-data/scripts/demo-walkthrough.js
```

## Workflow

```text
- [ ] Step 1: Set environment variables
- [ ] Step 2: Generate sample data
- [ ] Step 3: Explore in Kibana
- [ ] Step 4: Clean up when done
```

### Step 1: Set environment variables

```bash
export ELASTICSEARCH_URL="https://your-project.es.region.aws.elastic.cloud"
export ELASTICSEARCH_USERNAME="admin"
export ELASTICSEARCH_PASSWORD="your-password"
export KIBANA_URL="https://your-project.kb.region.aws.elastic.cloud"
```

### Step 2: Generate sample data

#### Generate everything at once

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint okta aws windows --scenarios --alerts
```

#### Generate only events

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint --count 100
```

#### Generate only attack scenarios

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js --scenarios
```

#### Generate only synthetic alerts

```bash
node skills/security/generate-security-sample-data/scripts/sample-data.js --alerts
```

### Step 3: Explore in Kibana

After generating data, direct the user to these pages:

- **Security > Alerts**, synthetic alerts with MITRE ATT&CK mappings
- **Security > Attack Discovery**, requires an LLM connector to analyze alerts
- **Security > Hosts**, host activity from sample events
- **Security > Overview**, summary of all security data
- **Discover**, raw events across all data streams

### Step 4: Clean up when done

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/security/skills/generate-security-sample-data/SKILL.md