security-generate-security-sample-data

Name: security-generate-security-sample-data
Availability: InStock
Author: elastic

Generate ECS-compliant security events and synthetic alerts for Elastic Security.

546|44|Updated Mar 6, 2026

Search Tags:#security #alert generation #sample data #attack simulation #demo data #elastic security

Ready to run

npx skills add https://github.com/elastic/agent-skills --skill security-generate-security-sample-data

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-generate-security-sample-data
Source: https://github.com/elastic/agent-skills/tree/main/skills/security/generate-security-sample-data
Command: npx skills add https://github.com/elastic/agent-skills --skill security-generate-security-sample-data

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill generates realistic security events, attack scenarios, and synthetic alerts to populate Elastic Security dashboards, the Alerts tab, and Attack Discovery, making it easy to demo, test, or set up a Proof of Concept.

Core Features & Use Cases

Generate Sample Data: Create ECS-compliant security events for various packages (system, endpoint, windows, aws, okta).
Simulate Attack Scenarios: Generate multi-step attack sequences to test detection rules.
Create Synthetic Alerts: Index alert documents directly into Elasticsearch for immediate use in Attack Discovery.
Use Case: You need to demonstrate the Elastic Security capabilities to a client but have no live data. Use this Skill to quickly populate the environment with realistic attack data and alerts.

Quick Start

Run the demo walkthrough script to generate everything and open Kibana.

Frequently Asked Questions about security-generate-security-sample-data

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate sample security alerts for Elastic Security dashboards?▼

You can populate Elastic Security dashboards by running Node.js scripts that generate ECS-compliant security events and synthetic alerts, indexing them directly into Elasticsearch to simulate multi-step attack scenarios across system, endpoint, Windows, AWS, and Okta environments.

Can I simulate multi-step attack scenarios to test detection rules in Elastic Security?▼

Yes, you can simulate multi-step attack sequences by generating realistic security events and synthetic alerts, allowing you to test detection rules and populate attack discovery without needing live network data.

What sample data types and environments are supported for attack simulation?▼

Attack simulation supports generating ECS-compliant sample data across system, endpoint, Windows, AWS, and Okta environments, providing diverse synthetic events to populate dashboards and test various detection scenarios.

Do I need Node.js to generate demo data for Elastic Security?▼

Yes, you need Node.js version 22 or higher, along with network access to Kibana and Elasticsearch with appropriate credentials, to run the scripts that generate demo data and populate your environment.

What's the best way to set up a Proof of Concept for Elastic Security without live data?▼

The best way to set up a Proof of Concept without live data is to run a demo walkthrough script that automatically generates realistic attack chains, synthetic alerts, and security events to populate your Kibana environment.

Why are my synthetic alerts not showing up in Elastic Security Attack Discovery?▼

Synthetic alerts may not appear if the Node.js scripts lack proper network access to Kibana or correct Elasticsearch credentials, preventing the ECS-compliant alert documents from being indexed properly into your environment.