Agent skill · security · elastic
security-generate-security-sample-data
Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, or setting up a POC.
Why this skill is useful
Adds executable scripts for generating ECS-compliant security events and attack scenarios that enhance Elastic Security capabilities.
What it needs
Requires node installed locally. Requires elasticsearch, kibana account access. About 4k tokens when loaded. Last updated 2026-07-22. 546 stars on the source repository.
What this skill does
Generate Security Sample Data Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic Security dashboards, the Alerts tab, and Attack Discovery. Quick start For a zero-friction experience that generates everything and opens Kibana: Workflow Step 1: Set environment variables Step 2: Generate sample data Generate everything at once Generate only events Generate only attack scenarios Generate only synthetic alerts Step 3: Explore in Kibana After generating data, direct the user to these pages: Security > Alerts — synthetic alerts with MITRE ATT&CK mappings Security > Attack Discovery — requires an LLM connector to analyze alerts Security > Hosts — host activity from sample events Security > Overview — summary of all security data Discover — raw events across all data streams Step 4: Clean up when done What gets generated Sample data spans 5 packages (system, endpoint, windows, aws, okta) and 4 focused attack scenarios covering the most common demo themes: Windows credential theft, AWS cloud privilege escalation, Okta identity takeover, and a full ransomware kill chain. Synthetic alert documents are indexed into .alerts-security.alerts-default with MITRE ATT&CK mappings, severity levels, and risk scores. All events use RFC 5737 / RFC 2606 safe addresses. For full tables of packages, scenarios, and alerts see references/sample-data-reference.md. Continuous mode Stream events to simulate a live environment: Every 5th batch includes an attack scenario; every 10th batch adds synthetic alerts. Press Ctrl+C to stop. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/generate-security-sample-data--f71b9e