add-scenario

Create and integrate attack, operational, or network scenarios into a log generation framework.

4|Updated Feb 7, 2026
One-click install
npx skills add https://github.com/lyderhansen/The-Fake-T-Shirt-Company --skill add-scenario
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: add-scenario
Source: https://github.com/lyderhansen/The-Fake-T-Shirt-Company/tree/main/.claude/skills/add-scenario
Command: npx skills add https://github.com/lyderhansen/The-Fake-T-Shirt-Company --skill add-scenario

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the process of defining and implementing new coordinated event sequences (scenarios) across multiple data sources, enabling more realistic and comprehensive log data generation for security and operational simulations.

Core Features & Use Cases

  • Scenario Definition: Register new scenarios with categories, sources, and timelines.
  • Code Implementation: Provides a template for creating scenario classes with day/hour-specific event generation logic.
  • Integration Guidance: Details how to integrate new scenarios into existing data generators.
  • Use Case: A security analyst needs to simulate a new type of advanced persistent threat (APT) attack. They use this Skill to define the attack's phases, the affected systems (e.g., firewall, authentication, endpoint), and the timeline of events, then implement the specific log generation logic for each phase.

Quick Start

Use the add-scenario skill to create a new attack scenario named 'phishing_campaign'.

Frequently Asked Questions about add-scenario

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I define a new attack scenario for security log generation?

You define an attack scenario by registering its categories, sources, and timelines, then implementing day and hour-specific event generation logic for each affected data source.

Can I simulate an APT attack across multiple data sources in Splunk?

Yes, you can simulate an APT attack across multiple data sources by defining the attack phases, affected systems like firewalls and endpoints, and generating structured event tags for Splunk filtering and analysis.

What is the best way to integrate coordinated event sequences into existing data generators?

The best way to integrate coordinated event sequences is to use a scenario class template that implements day and hour-specific event logic, then merge it into your existing generator scripts.

How do I structure event tagging for scenario filtering and analysis?

You structure event tagging for scenario filtering by applying structured tags to generated logs during the event generation logic implementation for each data source within the scenario framework.

Do I need to write custom code to implement event generation logic per data source?

Yes, you need to write custom code to implement event generation logic per data source, using the provided scenario class template to define day and hour-specific events for your operational simulation.