🚀 Enterprise SIEM Log Generator

The most comprehensive open-source cybersecurity log generator for SIEM testing, security training, and threat simulation. Generate realistic enterprise logs with MITRE ATT&CK framework integration, D3FEND defensive techniques, ML-based behavioral patterns, attack chain simulation, and high-performance worker threads.

Perfect for SOC analysts, penetration testers, security researchers, and cybersecurity educators who need realistic log data for testing SIEM rules, training detection capabilities, and simulating real-world attack scenarios.

🎯 Key Features

• 🎯 MITRE ATT&CK Integration - Generate logs mapped to specific techniques and tactics
• 🛡️ D3FEND Defensive Framework - Generate defensive response logs and SOC activities
• 🔗 Attack Chain Simulation - Execute multi-stage scenarios (APT29, Ransomware, Insider Threats)
• 🤖 AI-Enhanced Attack Chains - Dynamic, evolving attack scenarios with local AI (NO external APIs)
• 🧠 ML-Based Pattern Learning - Generate realistic, behavior-based logs using machine learning
• ⚡ High-Performance Generation - 6,000+ logs/second native, up to 20,000+ with worker threads and memory-first approach
• 📊 Real-time Monitoring - Built-in Prometheus metrics, Grafana dashboards, and health endpoints
• 🌐 SIEM Integration - Direct integration with Splunk, ELK, Wazuh, QRadar via HTTP/Syslog (tested and verified)
• 🐳 Docker & Kubernetes Ready - Production-ready containers with complete monitoring stack
• 🔄 Historical Replay - Replay and analyze existing log data with advanced filtering
• 📊 12+ Log Sources - Endpoint, Application, Server, Firewall, Cloud, Authentication, Database, and more

🚀 Quick Start

Installation

git clone https://github.com/your-username/log-generator.git
cd log-generator
npm install

Basic Usage

# Generate logs (stored in logs/current/ folder with monitoring)
npm run generate

# Generate for specific duration
npm run generate -- --duration 30m

# Generate MITRE ATT&CK specific logs
npm run generate -- --mitre-technique T1110 --duration 1h

# Run attack chain simulation
npm run attack-chains:execute apt29-cozy-bear

# NEW: AI-Enhanced Attack Chains
npm run attack-chains:execute-ai ransomware-ryuk --mode enhanced --ai-level medium
npm run attack-chains:training apt29-cozy-bear --variations 5 --progressive

# High-performance generation with worker threads
npm run performance-test -- --mode worker --workers 4 --duration 30s

# Test SIEM integrations
npm run performance-test -- --mode http --duration 10s
npm run performance-test -- --mode syslog --duration 10s

# Validate configuration (advisory warnings)
npm run validate-config

# Check status and performance
npm run status

# Access monitoring endpoints (when generator is running with monitoring enabled)
curl http://localhost:3000/health     # Health check
curl http://localhost:3000/metrics    # Prometheus metrics
curl http://localhost:3000/status     # Detailed status

# Disable monitoring if not needed (optional)
ENABLE_MONITORING=false npm run generate

Log Storage

All logs are automatically stored in the logs/current/ folder in JSON format by default. Historical logs are rotated to logs/historical/ for long-term storage and analysis.

🐳 Docker & Monitoring Stack

Quick Docker Setup

# Start complete monitoring stack (Prometheus + Grafana + SIEM testing)
SIEM_HTTP_URL="http://localhost:8000/post" \
SIEM_API_TOKEN="test-token" \
GRAFANA_PASSWORD="admin123" \
docker-compose -f docker-compose.production.yml up -d

# Access monitoring dashboards
# Grafana: http://localhost:3001 (admin/admin123)
# Prometheus: http://localhost:9090
# SIEM Test Endpoint: http://localhost:8000/post (POST requests)
# Log Generator Metrics: http://localhost:3000/metrics

Production Kubernetes Deployment

# Deploy to Kubernetes with auto-scaling
kubectl apply -f k8s/

# Check deployment status
kubectl get pods -n log-generator
kubectl get services -n log-generator

📋 Available Commands

For a complete list of commands, run: npx ts-node src/cli.ts --help

🛡️ SIEM Integration

The log generator supports multiple output formats and destinations:

Output Formats:

• JSON - Default format, stored in logs/current/
• Syslog - RFC3164/5424 compliant
• CEF - Common Event Format
• HTTP - Direct SIEM integration via REST API

Supported SIEMs:

• Splunk (HTTP Event Collector)
• Elastic/ELK Stack
• Wazuh
• QRadar
• Sentinel
• Any syslog-compatible SIEM

See SIEM_INTEGRATION.md for detailed integration guides.

⚡ High-Performance Features

• Worker Threads - Parallel log generation across multiple CPU cores
• Memory-First Approach - 10,000 log buffer before disk writes
• Network Output - Direct HTTP/Syslog streaming to SIEM (10-50x faster than disk)
• Batch Processing - Configurable batch sizes for optimal performance
• Real-time Monitoring - Performance statistics and system health monitoring

Expected performance: 5,000-20,000+ logs/second with proper configuration.

📚 Documentation

🎯 Use Cases

• 🔒 Security Testing - Test SIEM rules and detection capabilities
• 📚 Training & Education - Cybersecurity training with realistic scenarios
• 🧪 Development - Generate consistent test data for applications
• ⚡ Performance Testing - Load test log ingestion systems with high-volume generation
• 🎭 Incident Simulation - Recreate attack scenarios for analysis
• 🔄 Continuous Testing - Automated testing in CI/CD pipelines

🔧 System Requirements

• Node.js 18.0.0 or higher
• Memory 4GB+ RAM (8GB+ recommended for high-performance mode)
• Storage SSD recommended for high-volume generation
• Network For SIEM integration via HTTP/Syslog

See SYSTEM_REQUIREMENTS.md for detailed specifications.

🤝 Contributing

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

📄 License

This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.

🙏 Acknowledgments

• MITRE ATT&CK Framework - For the comprehensive threat modeling framework
• MITRE D3FEND Framework - For the defensive cybersecurity ontology
• Security Research Community - For attack pattern validation

⭐ Star this repository if it helps with your security testing and SIEM development!