generate-sample-data

name	generate-sample-data
description	Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.

Generate Security Sample Data

Generate ECS-compliant security events and synthetic alerts using the elastic-security MCP connector.

Tools (via elastic-security MCP connector)

Tool	Purpose
generate-sample-data	Generate events with interactive UI. Params: scenario, count

Attack Scenarios

Scenario	Description
windows-credential-theft	Mimikatz, procdump, credential dumping on Windows
aws-privilege-escalation	IAM policy changes, role assumption, access key creation
okta-identity-takeover	MFA factor reset, password change, session hijacking
ransomware-kill-chain	PowerShell execution, C2 beaconing, mass file encryption

Usage

• To generate all scenarios: call generate-sample-data without a scenario parameter
• To generate a specific scenario: pass scenario: "ransomware-kill-chain"
• All data is tagged with elastic-security-sample-data for safe cleanup
• The dashboard UI has a cleanup button to remove all generated data

After Generating

Direct the user to explore in Kibana:

• Security > Alerts — synthetic alerts with MITRE ATT&CK mappings
• Security > Attack Discovery — requires an LLM connector
• Security > Hosts — host activity from sample events