Security Documents Generator

Generate synthetic Security data for Elasticsearch and Kibana development, demos, and performance testing.

Note: For Elasticsearch 8.18 and earlier, use tag 8.18-compatibility.

What this tool can generate

• Alerts and events
• Entity Store data (users, hosts, services, generic entities)
• Privileged User Monitoring datasets
• Detection rules and gap scenarios
• Risk engine datasets and ingest loads
• Cloud Security Posture (Elastic + third-party sources)
• Entity Store performance data + baseline comparison reports

Requirements

• Node.js 24.18.0
• Yarn ^1.22.22
• Access to Elasticsearch and Kibana

Install

yarn

Configuration

On first run, the CLI creates config.json interactively if no valid config exists:

yarn start

You can authenticate with either:

• username + password
• apiKey

Example config.json (API key)

{
  "elastic": {
    "node": "https://example.es.us-west2.gcp.elastic-cloud.com",
    "apiKey": "your-elastic-api-key"
  },
  "kibana": {
    "node": "https://example.kb.us-west2.gcp.elastic-cloud.com:9243",
    "apiKey": "your-kibana-api-key"
  },
  "serverless": false,
  "eventIndex": "logs-testlogs-default"
}

Example config.json (local development with self-signed certificates)

{
  "elastic": {
    "node": "https://localhost:9200",
    "apiKey": "your-elastic-api-key"
  },
  "kibana": {
    "node": "https://localhost:5601",
    "apiKey": "your-kibana-api-key"
  },
  "serverless": false,
  "eventIndex": "logs-testlogs-default",
  "allowSelfSignedCerts": true
}

Security note: Only enable allowSelfSignedCerts for local development or testing environments. This option disables TLS certificate verification, which should never be used in production.

Example config.json (basic auth)

{
  "elastic": {
    "node": "http://localhost:9200",
    "username": "elastic",
    "password": "changeme"
  },
  "kibana": {
    "node": "http://localhost:5601",
    "username": "elastic",
    "password": "changeme"
  },
  "serverless": false,
  "eventIndex": "logs-testlogs-default"
}

Environment variable overrides

Environment variables override config.json values:

• ELASTIC_NODE, ELASTIC_USERNAME, ELASTIC_PASSWORD, ELASTIC_API_KEY
• KIBANA_NODE, KIBANA_USERNAME, KIBANA_PASSWORD, KIBANA_API_KEY
• SERVERLESS
• EVENT_INDEX
• EVENT_DATE_OFFSET_HOURS
• ALLOW_SELF_SIGNED_CERTS - Set to true or 1 to disable TLS certificate verification (for local development only)

CLI help

yarn start help

Quick start recipes

Alerts + risk score API timing

yarn start delete-alerts
yarn start generate-alerts -n 10000 -h 100 -u 100
yarn start test-risk-score

Entity Store (interactive)

yarn start entity-store

Privileged User Monitoring (quick)

yarn start privmon-quick --space default