generate-sample-data
Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.
Quellinformationen
- Repository
- elastic/example-mcp-app-security
- Letzte Quellaktivität
- 17. April 2026 um 20:40
- Erkannte Sprache von SKILL.md
- Englisch
- Sterne
- 25
- Forks
- 16
Installationsoptionen
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
SKILL.md wird angezeigt
SKILL.md
Quellanweisungen · Schreibgeschützte Vorschau- name
- generate-sample-data
- description
- Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.
# Generate Security Sample Data
Generate ECS-compliant security events and synthetic alerts using the `elastic-security` MCP connector.
## Tools (via elastic-security MCP connector)
| Tool | Purpose |
|------|---------|
| `generate-sample-data` | Generate events with interactive UI. Params: `scenario`, `count` |
## Attack Scenarios
| Scenario | Description |
|----------|-------------|
| `windows-credential-theft` | Mimikatz, procdump, credential dumping on Windows |
| `aws-privilege-escalation` | IAM policy changes, role assumption, access key creation |
| `okta-identity-takeover` | MFA factor reset, password change, session hijacking |
| `ransomware-kill-chain` | PowerShell execution, C2 beaconing, mass file encryption |
## Usage
- To generate all scenarios: call `generate-sample-data` without a scenario parameter
- To generate a specific scenario: pass `scenario: "ransomware-kill-chain"`
- All data is tagged with `elastic-security-sample-data` for safe cleanup
- The dashboard UI has a cleanup button to remove all generated data
## After Generating
Direct the user to explore in Kibana:
- **Security > Alerts** — synthetic alerts with MITRE ATT&CK mappings
- **Security > Attack Discovery** — requires an LLM connector
- **Security > Hosts** — host activity from sample events
Auf GitHub ansehen