Agent skill · security · elastic
security-generate-security-sample-data
Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, or setting up a POC.
Why this skill is useful
Adds executable scripts for generating ECS-compliant security events and attack scenarios that enhance Elastic Security capabilities.
What it needs
Requires node installed locally. Requires elastic account access. About 4k tokens when loaded. Last updated 2026-07-22. 546 stars on the source repository.
What this skill does
Generate Security Sample Data Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic Security dashboards, the Alerts tab, and Attack Discovery. Quick start For a zero-friction experience that generates everything and opens Kibana: Workflow Step 1: Set environment variables Step 2: Generate sample data Generate everything at once Generate only events Generate only attack scenarios Generate only synthetic alerts Step 3: Explore in Kibana After generating data, direct the user to these pages: Security > Alerts — synthetic alerts with MITRE ATT&CK mappings Security > Attack Discovery — requires an LLM connector to analyze alerts Security > Hosts — host activity from sample events Security > Overview — summary of all security data Discover — raw events across all data streams Step 4: Clean up when done What gets generated Sample data spans 5 packages (system, endpoint, windows, aws, okta) and 4 focused attack scenarios covering the most common demo themes: Windows credential theft, AWS cloud privilege escalation, Okta identity takeover, and a full ransomware kill chain. Synthetic alert documents are indexed into .alerts-security.alerts-default with MITRE ATT&CK mappings, severity levels, and risk scores. All events use RFC 5737 / RFC 2606 safe addresses. For full tables of packages, scenarios, and alerts see references/sample-data-reference.md. Continuous mode Stream events to simulate a live environment: Every 5th batch includes an attack scenario; every 10th batch adds synthetic alerts. Press Ctrl+C to stop. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/generate-security-sample-data