Security Generate Security Sample Data

Generates ECS-compliant security events, attack scenarios, and synthetic alerts straight into your Elastic Security deployment. You get five data packages (system, endpoint, Windows, AWS, Okta), four pre-built attack simulations including a full ransomware kill chain, and alerts that populate the actual Alerts tab with MITRE ATT&CK mappings. The demo-walkthrough script is genuinely thoughtful: it generates everything and opens Kibana for you. Continuous mode streams events on an interval so your dashboards stay live during presentations. This is purpose-built for POCs and demos where you need realistic security data without the usual painful setup. The cleanup flag actually works, which matters more than it should.

GitHub stars: 503
last updated: Jun 1, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill security-generate-security-sample-data --agent claude-code

Installs into .claude/skills of the current project.

Files

Generate Security Sample Data

Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic Security dashboards, the Alerts tab, and Attack Discovery.

Quick start

For a zero-friction experience that generates everything and opens Kibana:

node skills/security/generate-security-sample-data/scripts/demo-walkthrough.js

Workflow

- [ ] Step 1: Set environment variables
- [ ] Step 2: Generate sample data
- [ ] Step 3: Explore in Kibana
- [ ] Step 4: Clean up when done

Step 1: Set environment variables

export ELASTICSEARCH_URL="https://your-project.es.region.aws.elastic.cloud"
export ELASTICSEARCH_USERNAME="admin"
export ELASTICSEARCH_PASSWORD="your-password"
export KIBANA_URL="https://your-project.kb.region.aws.elastic.cloud"

Step 2: Generate sample data

Generate everything at once

node skills/security/generate-security-sample-data/scripts/sample-data.js \
  system endpoint okta aws windows --scenarios --alerts

Generate only events

SKILL.md on GitHub

Details

Repository: github.com/elastic/agent-skills
Categories: Security, AI & Agent Building
License: Apache-2.0
First seen: Jun 11, 2026