📖 Usage Guide

Quick Start

1. Generate Logs

python generate_logs.py

Output:

✅ Generated 2500 fake SIEM logs
📁 Output file: fake_siem_logs_2500.json

📊 Event Type Summary:
   Failed Login: 200
   Successful Login: 150
   ...

2. Convert to CSV

python convert_to_csv.py

Output:

🔄 Converting JSON logs to CSV...
📥 Loaded 2500 logs from fake_siem_logs_2500.json
📋 Fields detected: timestamp, event_type, event_code, user, host, source_ip, ...
✅ Successfully converted 2500 logs to CSV!
📁 Output file: fake_siem_logs_2500.csv

Customization

Modify Event Count

Edit generate_logs.py and change the loop counts:

# Generate 500 failed logins instead of 200
for _ in range(500):
    logs.append({
        "event_type": "Failed Login",
        ...
    })

Add Custom Hosts/Users

hosts = ["WIN-DC-01", "YOUR-SERVER-01", "CUSTOM-PC-01"]
users = ["your_admin", "custom_user", "test_account"]

Add New Event Types

# Custom event type
for _ in range(50):
    logs.append({
        "timestamp": timestamp(),
        "event_type": "Custom Event",
        "severity": "Medium",
        "custom_field": "your_value",
        "mitre_technique": "T1xxx"
    })

SIEM Integration Examples

Splunk

File Monitoring:

splunk add monitor /path/to/fake_siem_logs_2500.csv -sourcetype csv

HTTP Event Collector:

import requests
import json

with open("fake_siem_logs_2500.json") as f:
    logs = json.load(f)

for log in logs:
    requests.post(
        "https://splunk-server:8088/services/collector/event",
        headers={"Authorization": "Splunk YOUR_HEC_TOKEN"},
        json={"event": log}
    )

Elastic Stack

Filebeat Configuration:

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /path/to/fake_siem_logs_2500.json
    json.keys_under_root: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "siem-test-%{+yyyy.MM.dd}"

Microsoft Sentinel

Use Azure Log Analytics API to ingest JSON logs.

Severity Levels

Level	Description	Example Events
Info	Normal activity	Successful login, benign PowerShell
Low	Minor anomalies	USB device connected, firewall block
Medium	Potential threats	Failed login, port scan, RDP lateral
High	Likely malicious	Brute force, malware detected, privilege escalation
Critical	Active attack	Ransomware, C2 communication, credential dumping

MITRE ATT&CK Reference

All events with mitre_technique field can be correlated to:

MITRE ATT&CK Navigator
Splunk Enterprise Security MITRE ATT&CK App
Elastic SIEM Detection Rules

Troubleshooting

Unicode Errors

Ensure UTF-8 encoding in your terminal:

# PowerShell
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8

CSV Import Issues

Some fields contain special characters. Use proper quoting:

writer = csv.DictWriter(f, fieldnames=fields, quoting=csv.QUOTE_ALL)

FilesExpand file tree

USAGE.md

Latest commit

History