security-generate-security-sample-data

Security-generate-security-sample-data generates ECS-compliant sample security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic Security dashboards, the Alerts tab, and Attack Discovery. It solves the problem of quickly seeding a realistic-looking Elastic Security environment for demos, dashboard population, detection-rule testing, or proof-of-concept setups without needing real telemetry.

The skill is driven by Node.js scripts. The zero-friction demo-walkthrough.js runner generates everything and opens Kibana, while sample-data.js provides granular control. Its workflow is: set environment variables, generate data, explore in Kibana, and clean up. Data spans five packages (system, endpoint, windows, aws, okta) and four attack scenarios: Windows credential theft, AWS cloud privilege escalation, Okta identity takeover, and a full ransomware kill chain. Synthetic alerts are indexed directly into .alerts-security.alerts-default with MITRE ATT&CK mappings, severity levels, and risk scores, and do not require detection rules to be installed or enabled. Key sample-data.js flags include --count/-n (events per package, default 50), --scenarios, --scenario NAME, --alerts, --cleanup, --continuous with --interval N for live streaming, --json/-j, and --yes/-y to skip confirmation prompts. In continuous mode every 5th batch includes an attack scenario and every 10th batch adds synthetic alerts. All generated documents are tagged with tags: ["elastic-security-sample-data"] so cleanup, which runs deleteByQuery across sample data indices, only removes marked documents, with a fallback that scans _source.tags for the last 14 days.

The skill targets security engineers and Elastic users setting up demos or testing. It requires Node.js 22+ and network access to Kibana and Elasticsearch, configured through environment variables: KIBANA_URL plus KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD, and ELASTICSEARCH_URL or ELASTICSEARCH_CLOUD_ID plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD. Attack Discovery additionally requires an LLM connector (such as OpenAI, Anthropic, or Google Gemini) configured in Kibana under Stack Management > Connectors, and the Complete project tier unlocks the feature. The skill warns against running against production clusters unless intentionally injecting synthetic data, prompts for confirmation on all write operations, and uses RFC 5737 / RFC 2606 safe addresses.