/generate-security-sample-data

name: security-generate-security-sample-data
description: >
  Generate sample security events, attack scenarios, and synthetic alerts for Elastic
  Security. Use when demoing, populating dashboards, testing detection rules, or setting
  up a POC.
compatibility: >
  Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables:
  KIBANA_URL plus KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD; ELASTICSEARCH_URL
  or ELASTICSEARCH_CLOUD_ID plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD.
metadata:
  author: elastic
  version: 0.1.0

Generate Security Sample Data

Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic Security dashboards, the Alerts tab, and Attack Discovery.

Quick start

For a zero-friction experience that generates everything and opens Kibana:

node skills/security/generate-security-sample-data/scripts/demo-walkthrough.js

Workflow

- [ ] Step 1: Set environment variables
- [ ] Step 2: Generate sample data
- [ ] Step 3: Explore in Kibana
- [ ] Step 4: Clean up when done

Step 1: Set environment variables

export ELASTICSEARCH_URL="https://your-project.es.region.aws.elastic.cloud"
export ELASTICSEARCH_USERNAME="admin"
export ELASTICSEARCH_PASSWORD="your-password"
export KIBANA_URL="https://your-project.kb.region.aws.elastic.cloud"

Step 2: Generate sample data

Generate everything at once

node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint okta aws windows --scenarios --alerts

Generate only events

node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint --count 100

Generate only attack scenarios

node skills/security/generate-security-sample-data/scripts/sample-data.js --scenarios

Generate only synthetic alerts

node skills/security/generate-security-sample-data/scripts/sample-data.js --alerts

Step 3: Explore in Kibana

After generating data, direct the user to these pages:

• **Security > Alerts** — synthetic alerts with MITRE ATT&CK mappings
• **Security > Attack Discovery** — requires an LLM connector to analyze alerts
• **Security > Hosts** — host activity from sample events
• **Security > Overview** — summary of all security data
• **Discover** — raw events across all data streams

Step 4: Clean up when done

node skills/security/generate-security-sample-data/scripts/sample-data.js --cleanup

What gets generated

Sample data spans 5 packages (system, endpoint, windows, aws, okta) and 4 focused attack scenarios covering the most common demo themes: Windows credential theft, AWS cloud privilege escalation, Okta identity takeover, and a full ransomware kill chain. Synthetic alert documents are indexed into `.alerts-security.alerts-default` with MITRE ATT&CK mappings, severity levels, and risk scores.

All events use RFC 5737 / RFC 2606 safe addresses. For full tables of packages, scenarios, and alerts see [references/sample-data-reference.md](references/sample-data-reference.md).

Continuous mode

Stream events to simulate a live environment:

node skills/security/generate-security-sample-data/scripts/sample-data.js \
  --continuous --interval 15

Every 5th batch includes an attack scenario; every 10th batch adds synthetic alerts. Press Ctrl+C to stop.

Tool reference

sample-data.js

| Flag | Description | | ----------------- | ------------------------------------------------ | | `--count`, `-n` | Events per package (default: 50) | | `--scenarios` | Run all attack simulation scenarios | | `--scenario NAME` | Run a specific scenario | | `--alerts` | Generate synthetic alert documents | | `--cleanup` | Remove all sample data and alerts | | `--continuous` | Stream live events (Ctrl+C to stop) | | `--interval N` | Seconds between continuous batches (default: 30) | | `--json`, `-j` | Output results as JSON | | `--yes`, `-y` | Skip confirmation prompts |

demo-walkthrough.js

Zero-friction runner that generates everything and opens Kibana.

| Flag | Description | | -------------- | ------------------------------------- | | `--cleanup` | Remove all sample data, alerts, case | | `--continuous` | Generate then stream live events | | `--count N` | Events per package (default: 50) | | `--interval N` | Seconds between batches (default: 30) |

Examples

Quick demo for a stakeholder

> "Set up a demo environment so I can show Attack Discovery to my VP."

node skills/security/generate-security-sample-data/scripts/demo-walkthrough.js

Targeted scenario testing

> "Generate only the ransomware attack chain to test our detection rules."

node skills/security/generate-security-sample-data/scripts/sample-data.js \
  --scenario ransomwareChain --alerts

Simulating a live SOC

> "Keep generating events so the dashboards stay active during the demo."

node skills/security/generate-security-sample-data/scripts/demo-walkthrough.js --continuous

Cleaning up after a demo

> "Remove all sample data from my project."

node skills/security/generate-security-sample-data/scripts/sample-data.js --cleanup

Guidelines

• All generated documents are tagged with `tags: ["elastic-security-sample-data"]` for safe cleanup. The cleanup command

only deletes documents with this marker.

• If marker fields are not indexed in a data stream, cleanup falls back to scanning `_source.tags` for matching sample

documents from the last 14 days.

• Synthetic alerts are indexed directly into `.alerts