🔥 Generate 2,500+ Realistic Security Events | 🎯 MITRE ATT&CK Mapped | 🖥️ Splunk, Elastic, QRadar Ready

---

📋 Overview

SIEM Log Generator is a Python-based tool that generates 2,500+ realistic security events for SOC analyst training, SIEM system testing, and detection rule development. The logs are mapped to the MITRE ATT&CK framework and cover 25+ distinct event types.

🎯 Use Cases

• SOC Analyst Training: Practice threat hunting and incident response
• SIEM Testing: Validate Splunk, Elastic, QRadar ingestion pipelines
• Detection Engineering: Develop and test correlation rules
• Security Tool Evaluation: Benchmark SIEM and EDR solutions
• CTF & Lab Environments: Create realistic attack scenarios

---

⚡ Features

Category	Event Types	MITRE Techniques
🔐 Authentication	Failed/Successful Logins, Brute Force, Password Spray, Kerberoasting	T1110, T1558
⚡ Execution	PowerShell, LOLBIN, Scheduled Tasks	T1059, T1218, T1053
🔧 Persistence	Registry Modification, Service Installation	T1547, T1543
🌐 Lateral Movement	RDP, SMB/Admin$, PsExec, WMI	T1021, T1570, T1047
📤 Exfiltration	C2 Outbound, DNS Tunneling, Large Data Transfer	T1071, T1048
🛡️ Endpoint	Malware Detection, Credential Dumping, Process Injection	T1003, T1055
☁️ Cloud Security	IAM Abuse, S3 Exposure, Impossible Travel	T1098
🌊 Network	Firewall Blocks, Port Scans, DDoS, IDS Alerts	T1046
📧 Email	Phishing, Malicious Attachments, DLP Violations	T1566
🦠 Ransomware	Mass Encryption, Shadow Copy Deletion	T1486

---

🚀 Quick Start

Prerequisites

• Python 3.8 or higher
• No external dependencies required (uses standard library only)

Installation

# Clone the repository
git clone https://github.com/YOUR_USERNAME/siem-log-generator.git
cd siem-log-generator

# Generate logs (JSON format)
python generate_logs.py

# Convert to CSV (optional)
python convert_to_csv.py

Output Files

File	Format	Description
fake_siem_logs_2500.json	JSON	Full event details with nested objects
fake_siem_logs_2500.csv	CSV	Flattened format for SIEM import

---

🖥️ SOC Dashboard Preview

👆 This dashboard was built using the generated logs!

📖 View Complete Splunk Dashboard Build Guide →

📖 View Enterprise SOC Dashboards (Real-World Examples) →

The guides include:

• Step-by-step instructions to import data into Splunk
• Real SPL queries for each dashboard panel
• Complete dashboard XML for one-click import
• 10 Real-World Enterprise Dashboard Types
• Industry-specific examples (Banking, Healthcare, Manufacturing, E-commerce)
• Dark theme configuration

---

📊 Sample Output

JSON Event Example

{
  "timestamp": "2026-01-07T14:23:45.123456",
  "event_code": 4625,
  "event_type": "Brute Force Attempt",
  "severity": "High",
  "user": "administrator",
  "host": "WIN-DC-01",
  "source_ip": "103.45.78.21",
  "attempt_count": 247,
  "mitre_technique": "T1110.001"
}

Event Distribution

📊 Event Type Summary:
   Failed Login: 200
   Successful Login: 150
   Brute Force Attempt: 100
   Firewall Block: 100
   Benign PowerShell: 100
   Password Spray: 80
   PowerShell Execution: 80
   C2 Outbound Connection: 80
   ... and 17 more event types

---

🔧 Configuration

Customize the generator by modifying the configuration section in generate_logs.py:

# Target hosts
hosts = ["WIN-DC-01", "FIN-SERVER-02", "USER-PC-07", ...]

# User accounts
users = ["administrator", "backup_admin", "finance_admin", ...]

# IP ranges
internal_ips = ["192.168.1.50", "192.168.1.101", ...]
external_ips = ["103.45.78.21", "45.67.22.10", ...]

# Known malicious indicators
malicious_domains = ["evil-c2[.]com", "malware-drop[.]net", ...]

---

📁 Project Structure

siem-log-generator/
├── 📜 generate_logs.py              # Main log generation script (622 lines)
├── 📜 convert_to_csv.py             # JSON to CSV converter
├── 📊 fake_siem_logs_2500.json      # Generated logs (JSON format)
├── 📊 fake_siem_logs_2500.csv       # Generated logs (CSV format)
├── 📖 README.md                     # Project documentation
├── 📖 USAGE.md                      # Detailed usage guide
├── 📋 requirements.txt              # Python dependencies
├── ⚖️ LICENSE                        # MIT License
├── 🔒 .gitignore                    # Git ignore rules
└── 📁 docs/
    ├── 📖 SPLUNK_DASHBOARD_GUIDE.md     # Complete Splunk dashboard tutorial
    ├── 📖 ENTERPRISE_SOC_DASHBOARDS.md  # 10 Real-world enterprise dashboards
    └── 📁 images/
        └── 🖼️ dashboard_preview.png      # Dashboard screenshot

---

🔗 SIEM Integration

Splunk

# Use the CSV file for HEC or file monitoring
$SPLUNK_HOME/bin/splunk add monitor /path/to/fake_siem_logs_2500.csv

Elastic/Logstash

# logstash.conf
input {
  file {
    path => "/path/to/fake_siem_logs_2500.json"
    codec => json
    start_position => "beginning"
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "siem-test-logs"
  }
}

QRadar

Import CSV via Log File Protocol or Universal DSM.

---

🗺️ MITRE ATT&CK Coverage

Tactic	Techniques Covered
Initial Access	T1566 (Phishing)
Execution	T1059 (PowerShell), T1218 (LOLBIN), T1047 (WMI)
Persistence	T1053 (Scheduled Task), T1547 (Registry), T1543 (Service)
Privilege Escalation	T1068 (Exploitation), T1003 (Credential Access)
Defense Evasion	T1070 (Log Clearing), T1055 (Process Injection), T1562 (Disable Security)
Credential Access	T1110 (Brute Force), T1558 (Kerberoasting)
Discovery	T1046 (Network Scan)
Lateral Movement	T1021 (RDP/SMB), T1570 (PsExec)
Collection	T1048 (Exfiltration)
Command & Control	T1071 (C2), T1071.004 (DNS Tunnel)
Impact	T1486 (Ransomware)

---

🛠️ Tech Stack

---

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

👤 Author

Amresh Kumar
Security Enthusiast | SOC Analyst | Detection Engineer

---

🤝 Contributing

Contributions are welcome! Feel free to:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/new-event-type)
3. Commit changes (git commit -m 'Add new event type')
4. Push to branch (git push origin feature/new-event-type)
5. Open a Pull Request

---

⭐ Support

If you found this project helpful, please give it a ⭐ on GitHub!

---

Built for Blue Team, Red Team & SOC Analysts 🛡️