[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-security-generate-security-sample-data":3,"mdc-nn9dhb-key":34,"related-org-elastic-security-generate-security-sample-data":1439,"related-repo-elastic-security-generate-security-sample-data":1607},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"security-generate-security-sample-data","generate sample security events","Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, or setting up a POC.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Dashboards","dashboards",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Testing","testing",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:49:29.459336",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fsecurity\u002Fgenerate-security-sample-data","---\nname: security-generate-security-sample-data\ndescription: >\n  Generate sample security events, attack scenarios, and synthetic alerts for Elastic\n  Security. Use when demoing, populating dashboards, testing detection rules, or setting\n  up a POC.\ncompatibility: >\n  Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables:\n  KIBANA_URL plus KIBANA_API_KEY or KIBANA_USERNAME\u002FKIBANA_PASSWORD; ELASTICSEARCH_URL\n  or ELASTICSEARCH_CLOUD_ID plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Generate Security Sample Data\n\nGenerate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic\nSecurity dashboards, the Alerts tab, and Attack Discovery.\n\n## Quick start\n\nFor a zero-friction experience that generates everything and opens Kibana:\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fdemo-walkthrough.js\n```\n\n## Workflow\n\n```text\n- [ ] Step 1: Set environment variables\n- [ ] Step 2: Generate sample data\n- [ ] Step 3: Explore in Kibana\n- [ ] Step 4: Clean up when done\n```\n\n### Step 1: Set environment variables\n\n```bash\nexport ELASTICSEARCH_URL=\"https:\u002F\u002Fyour-project.es.region.aws.elastic.cloud\"\nexport ELASTICSEARCH_USERNAME=\"admin\"\nexport ELASTICSEARCH_PASSWORD=\"your-password\"\nexport KIBANA_URL=\"https:\u002F\u002Fyour-project.kb.region.aws.elastic.cloud\"\n```\n\n### Step 2: Generate sample data\n\n#### Generate everything at once\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  system endpoint okta aws windows --scenarios --alerts\n```\n\n#### Generate only events\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  system endpoint --count 100\n```\n\n#### Generate only attack scenarios\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js --scenarios\n```\n\n#### Generate only synthetic alerts\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js --alerts\n```\n\n### Step 3: Explore in Kibana\n\nAfter generating data, direct the user to these pages:\n\n- **Security > Alerts** — synthetic alerts with MITRE ATT&CK mappings\n- **Security > Attack Discovery** — requires an LLM connector to analyze alerts\n- **Security > Hosts** — host activity from sample events\n- **Security > Overview** — summary of all security data\n- **Discover** — raw events across all data streams\n\n### Step 4: Clean up when done\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js --cleanup\n```\n\n## What gets generated\n\nSample data spans 5 packages (system, endpoint, windows, aws, okta) and 4 focused attack scenarios covering the most\ncommon demo themes: Windows credential theft, AWS cloud privilege escalation, Okta identity takeover, and a full\nransomware kill chain. Synthetic alert documents are indexed into `.alerts-security.alerts-default` with MITRE ATT&CK\nmappings, severity levels, and risk scores.\n\nAll events use RFC 5737 \u002F RFC 2606 safe addresses. For full tables of packages, scenarios, and alerts see\n[references\u002Fsample-data-reference.md](references\u002Fsample-data-reference.md).\n\n## Continuous mode\n\nStream events to simulate a live environment:\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  --continuous --interval 15\n```\n\nEvery 5th batch includes an attack scenario; every 10th batch adds synthetic alerts. Press Ctrl+C to stop.\n\n## Tool reference\n\n### sample-data.js\n\n| Flag              | Description                                      |\n| ----------------- | ------------------------------------------------ |\n| `--count`, `-n`   | Events per package (default: 50)                 |\n| `--scenarios`     | Run all attack simulation scenarios              |\n| `--scenario NAME` | Run a specific scenario                          |\n| `--alerts`        | Generate synthetic alert documents               |\n| `--cleanup`       | Remove all sample data and alerts                |\n| `--continuous`    | Stream live events (Ctrl+C to stop)              |\n| `--interval N`    | Seconds between continuous batches (default: 30) |\n| `--json`, `-j`    | Output results as JSON                           |\n| `--yes`, `-y`     | Skip confirmation prompts                        |\n\n### demo-walkthrough.js\n\nZero-friction runner that generates everything and opens Kibana.\n\n| Flag           | Description                           |\n| -------------- | ------------------------------------- |\n| `--cleanup`    | Remove all sample data, alerts, case  |\n| `--continuous` | Generate then stream live events      |\n| `--count N`    | Events per package (default: 50)      |\n| `--interval N` | Seconds between batches (default: 30) |\n\n## Examples\n\n### Quick demo for a stakeholder\n\n> \"Set up a demo environment so I can show Attack Discovery to my VP.\"\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fdemo-walkthrough.js\n```\n\n### Targeted scenario testing\n\n> \"Generate only the ransomware attack chain to test our detection rules.\"\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  --scenario ransomwareChain --alerts\n```\n\n### Simulating a live SOC\n\n> \"Keep generating events so the dashboards stay active during the demo.\"\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fdemo-walkthrough.js --continuous\n```\n\n### Cleaning up after a demo\n\n> \"Remove all sample data from my project.\"\n\n```bash\nnode skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js --cleanup\n```\n\n## Guidelines\n\n- All generated documents are tagged with `tags: [\"elastic-security-sample-data\"]` for safe cleanup. The cleanup command\n  only deletes documents with this marker.\n- If marker fields are not indexed in a data stream, cleanup falls back to scanning `_source.tags` for matching sample\n  documents from the last 14 days.\n- Synthetic alerts are indexed directly into `.alerts-security.alerts-default` — they do not require detection rules to\n  be installed or enabled.\n- Attack Discovery requires an LLM connector (OpenAI, Anthropic, Google Gemini, or similar) configured in Kibana under\n  Stack Management > Connectors. The \"Complete\" project tier unlocks the feature, but the connector must be set up\n  separately.\n- Use the `case-management` skill for creating investigation cases from alerts.\n\n## Production use\n\n- **Do not run against production clusters** unless you intend to inject synthetic data alongside real alerts. Sample\n  events and alerts are tagged for cleanup but will appear in dashboards, the Alerts tab, and Attack Discovery alongside\n  real data.\n- All write operations (`generate`, `--cleanup`, `--continuous`) prompt for confirmation. Pass `--yes` or `-y` to skip\n  when called by an agent.\n- `--cleanup` runs `deleteByQuery` across all sample data indices — verify environment variables point to the intended\n  cluster before running.\n- `--continuous` mode indexes events indefinitely until manually stopped with Ctrl+C.\n\n## Environment variables\n\n| Variable                 | Required | Description                                |\n| ------------------------ | -------- | ------------------------------------------ |\n| `ELASTICSEARCH_URL`      | Yes      | Elasticsearch URL                          |\n| `ELASTICSEARCH_API_KEY`  | Yes\\*    | Elasticsearch API key                      |\n| `ELASTICSEARCH_USERNAME` | Yes\\*    | Elasticsearch username (alternative)       |\n| `ELASTICSEARCH_PASSWORD` | Yes\\*    | Elasticsearch password (alternative)       |\n| `KIBANA_URL`             | No       | Kibana URL (for case creation and links)   |\n| `KIBANA_USERNAME`        | No       | Kibana username (if using Kibana features) |\n| `KIBANA_PASSWORD`        | No       | Kibana password (if using Kibana features) |\n\n\\*Either API key or username\u002Fpassword is required for Elasticsearch.\n",{"data":35,"body":39},{"name":4,"description":6,"compatibility":36,"metadata":37},"Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables: KIBANA_URL plus KIBANA_API_KEY or KIBANA_USERNAME\u002FKIBANA_PASSWORD; ELASTICSEARCH_URL or ELASTICSEARCH_CLOUD_ID plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD.\n",{"author":8,"version":38},"0.1.0",{"type":40,"children":41},"root",[42,51,57,64,69,99,105,115,122,255,261,268,330,336,380,386,409,415,437,443,448,504,510,533,539,552,565,571,576,616,621,627,633,836,842,847,931,937,943,952,969,975,983,1022,1028,1036,1060,1066,1074,1095,1101,1160,1166,1246,1252,1428,1433],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"generate-security-sample-data",[48],{"type":49,"value":50},"text","Generate Security Sample Data",{"type":43,"tag":52,"props":53,"children":54},"p",{},[55],{"type":49,"value":56},"Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic\nSecurity dashboards, the Alerts tab, and Attack Discovery.",{"type":43,"tag":58,"props":59,"children":61},"h2",{"id":60},"quick-start",[62],{"type":49,"value":63},"Quick start",{"type":43,"tag":52,"props":65,"children":66},{},[67],{"type":49,"value":68},"For a zero-friction experience that generates everything and opens Kibana:",{"type":43,"tag":70,"props":71,"children":76},"pre",{"className":72,"code":73,"language":74,"meta":75,"style":75},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fdemo-walkthrough.js\n","bash","",[77],{"type":43,"tag":78,"props":79,"children":80},"code",{"__ignoreMap":75},[81],{"type":43,"tag":82,"props":83,"children":86},"span",{"class":84,"line":85},"line",1,[87,93],{"type":43,"tag":82,"props":88,"children":90},{"style":89},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[91],{"type":49,"value":92},"node",{"type":43,"tag":82,"props":94,"children":96},{"style":95},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[97],{"type":49,"value":98}," skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fdemo-walkthrough.js\n",{"type":43,"tag":58,"props":100,"children":102},{"id":101},"workflow",[103],{"type":49,"value":104},"Workflow",{"type":43,"tag":70,"props":106,"children":110},{"className":107,"code":109,"language":49,"meta":75},[108],"language-text","- [ ] Step 1: Set environment variables\n- [ ] Step 2: Generate sample data\n- [ ] Step 3: Explore in Kibana\n- [ ] Step 4: Clean up when done\n",[111],{"type":43,"tag":78,"props":112,"children":113},{"__ignoreMap":75},[114],{"type":49,"value":109},{"type":43,"tag":116,"props":117,"children":119},"h3",{"id":118},"step-1-set-environment-variables",[120],{"type":49,"value":121},"Step 1: Set environment variables",{"type":43,"tag":70,"props":123,"children":125},{"className":72,"code":124,"language":74,"meta":75,"style":75},"export ELASTICSEARCH_URL=\"https:\u002F\u002Fyour-project.es.region.aws.elastic.cloud\"\nexport ELASTICSEARCH_USERNAME=\"admin\"\nexport ELASTICSEARCH_PASSWORD=\"your-password\"\nexport KIBANA_URL=\"https:\u002F\u002Fyour-project.kb.region.aws.elastic.cloud\"\n",[126],{"type":43,"tag":78,"props":127,"children":128},{"__ignoreMap":75},[129,165,195,225],{"type":43,"tag":82,"props":130,"children":131},{"class":84,"line":85},[132,138,144,150,155,160],{"type":43,"tag":82,"props":133,"children":135},{"style":134},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[136],{"type":49,"value":137},"export",{"type":43,"tag":82,"props":139,"children":141},{"style":140},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[142],{"type":49,"value":143}," ELASTICSEARCH_URL",{"type":43,"tag":82,"props":145,"children":147},{"style":146},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[148],{"type":49,"value":149},"=",{"type":43,"tag":82,"props":151,"children":152},{"style":146},[153],{"type":49,"value":154},"\"",{"type":43,"tag":82,"props":156,"children":157},{"style":95},[158],{"type":49,"value":159},"https:\u002F\u002Fyour-project.es.region.aws.elastic.cloud",{"type":43,"tag":82,"props":161,"children":162},{"style":146},[163],{"type":49,"value":164},"\"\n",{"type":43,"tag":82,"props":166,"children":168},{"class":84,"line":167},2,[169,173,178,182,186,191],{"type":43,"tag":82,"props":170,"children":171},{"style":134},[172],{"type":49,"value":137},{"type":43,"tag":82,"props":174,"children":175},{"style":140},[176],{"type":49,"value":177}," ELASTICSEARCH_USERNAME",{"type":43,"tag":82,"props":179,"children":180},{"style":146},[181],{"type":49,"value":149},{"type":43,"tag":82,"props":183,"children":184},{"style":146},[185],{"type":49,"value":154},{"type":43,"tag":82,"props":187,"children":188},{"style":95},[189],{"type":49,"value":190},"admin",{"type":43,"tag":82,"props":192,"children":193},{"style":146},[194],{"type":49,"value":164},{"type":43,"tag":82,"props":196,"children":198},{"class":84,"line":197},3,[199,203,208,212,216,221],{"type":43,"tag":82,"props":200,"children":201},{"style":134},[202],{"type":49,"value":137},{"type":43,"tag":82,"props":204,"children":205},{"style":140},[206],{"type":49,"value":207}," ELASTICSEARCH_PASSWORD",{"type":43,"tag":82,"props":209,"children":210},{"style":146},[211],{"type":49,"value":149},{"type":43,"tag":82,"props":213,"children":214},{"style":146},[215],{"type":49,"value":154},{"type":43,"tag":82,"props":217,"children":218},{"style":95},[219],{"type":49,"value":220},"your-password",{"type":43,"tag":82,"props":222,"children":223},{"style":146},[224],{"type":49,"value":164},{"type":43,"tag":82,"props":226,"children":228},{"class":84,"line":227},4,[229,233,238,242,246,251],{"type":43,"tag":82,"props":230,"children":231},{"style":134},[232],{"type":49,"value":137},{"type":43,"tag":82,"props":234,"children":235},{"style":140},[236],{"type":49,"value":237}," KIBANA_URL",{"type":43,"tag":82,"props":239,"children":240},{"style":146},[241],{"type":49,"value":149},{"type":43,"tag":82,"props":243,"children":244},{"style":146},[245],{"type":49,"value":154},{"type":43,"tag":82,"props":247,"children":248},{"style":95},[249],{"type":49,"value":250},"https:\u002F\u002Fyour-project.kb.region.aws.elastic.cloud",{"type":43,"tag":82,"props":252,"children":253},{"style":146},[254],{"type":49,"value":164},{"type":43,"tag":116,"props":256,"children":258},{"id":257},"step-2-generate-sample-data",[259],{"type":49,"value":260},"Step 2: Generate sample data",{"type":43,"tag":262,"props":263,"children":265},"h4",{"id":264},"generate-everything-at-once",[266],{"type":49,"value":267},"Generate everything at once",{"type":43,"tag":70,"props":269,"children":271},{"className":72,"code":270,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  system endpoint okta aws windows --scenarios --alerts\n",[272],{"type":43,"tag":78,"props":273,"children":274},{"__ignoreMap":75},[275,292],{"type":43,"tag":82,"props":276,"children":277},{"class":84,"line":85},[278,282,287],{"type":43,"tag":82,"props":279,"children":280},{"style":89},[281],{"type":49,"value":92},{"type":43,"tag":82,"props":283,"children":284},{"style":95},[285],{"type":49,"value":286}," skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js",{"type":43,"tag":82,"props":288,"children":289},{"style":140},[290],{"type":49,"value":291}," \\\n",{"type":43,"tag":82,"props":293,"children":294},{"class":84,"line":167},[295,300,305,310,315,320,325],{"type":43,"tag":82,"props":296,"children":297},{"style":95},[298],{"type":49,"value":299},"  system",{"type":43,"tag":82,"props":301,"children":302},{"style":95},[303],{"type":49,"value":304}," endpoint",{"type":43,"tag":82,"props":306,"children":307},{"style":95},[308],{"type":49,"value":309}," okta",{"type":43,"tag":82,"props":311,"children":312},{"style":95},[313],{"type":49,"value":314}," aws",{"type":43,"tag":82,"props":316,"children":317},{"style":95},[318],{"type":49,"value":319}," windows",{"type":43,"tag":82,"props":321,"children":322},{"style":95},[323],{"type":49,"value":324}," --scenarios",{"type":43,"tag":82,"props":326,"children":327},{"style":95},[328],{"type":49,"value":329}," --alerts\n",{"type":43,"tag":262,"props":331,"children":333},{"id":332},"generate-only-events",[334],{"type":49,"value":335},"Generate only events",{"type":43,"tag":70,"props":337,"children":339},{"className":72,"code":338,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  system endpoint --count 100\n",[340],{"type":43,"tag":78,"props":341,"children":342},{"__ignoreMap":75},[343,358],{"type":43,"tag":82,"props":344,"children":345},{"class":84,"line":85},[346,350,354],{"type":43,"tag":82,"props":347,"children":348},{"style":89},[349],{"type":49,"value":92},{"type":43,"tag":82,"props":351,"children":352},{"style":95},[353],{"type":49,"value":286},{"type":43,"tag":82,"props":355,"children":356},{"style":140},[357],{"type":49,"value":291},{"type":43,"tag":82,"props":359,"children":360},{"class":84,"line":167},[361,365,369,374],{"type":43,"tag":82,"props":362,"children":363},{"style":95},[364],{"type":49,"value":299},{"type":43,"tag":82,"props":366,"children":367},{"style":95},[368],{"type":49,"value":304},{"type":43,"tag":82,"props":370,"children":371},{"style":95},[372],{"type":49,"value":373}," --count",{"type":43,"tag":82,"props":375,"children":377},{"style":376},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[378],{"type":49,"value":379}," 100\n",{"type":43,"tag":262,"props":381,"children":383},{"id":382},"generate-only-attack-scenarios",[384],{"type":49,"value":385},"Generate only attack scenarios",{"type":43,"tag":70,"props":387,"children":389},{"className":72,"code":388,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js --scenarios\n",[390],{"type":43,"tag":78,"props":391,"children":392},{"__ignoreMap":75},[393],{"type":43,"tag":82,"props":394,"children":395},{"class":84,"line":85},[396,400,404],{"type":43,"tag":82,"props":397,"children":398},{"style":89},[399],{"type":49,"value":92},{"type":43,"tag":82,"props":401,"children":402},{"style":95},[403],{"type":49,"value":286},{"type":43,"tag":82,"props":405,"children":406},{"style":95},[407],{"type":49,"value":408}," --scenarios\n",{"type":43,"tag":262,"props":410,"children":412},{"id":411},"generate-only-synthetic-alerts",[413],{"type":49,"value":414},"Generate only synthetic alerts",{"type":43,"tag":70,"props":416,"children":418},{"className":72,"code":417,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js --alerts\n",[419],{"type":43,"tag":78,"props":420,"children":421},{"__ignoreMap":75},[422],{"type":43,"tag":82,"props":423,"children":424},{"class":84,"line":85},[425,429,433],{"type":43,"tag":82,"props":426,"children":427},{"style":89},[428],{"type":49,"value":92},{"type":43,"tag":82,"props":430,"children":431},{"style":95},[432],{"type":49,"value":286},{"type":43,"tag":82,"props":434,"children":435},{"style":95},[436],{"type":49,"value":329},{"type":43,"tag":116,"props":438,"children":440},{"id":439},"step-3-explore-in-kibana",[441],{"type":49,"value":442},"Step 3: Explore in Kibana",{"type":43,"tag":52,"props":444,"children":445},{},[446],{"type":49,"value":447},"After generating data, direct the user to these pages:",{"type":43,"tag":449,"props":450,"children":451},"ul",{},[452,464,474,484,494],{"type":43,"tag":453,"props":454,"children":455},"li",{},[456,462],{"type":43,"tag":457,"props":458,"children":459},"strong",{},[460],{"type":49,"value":461},"Security > Alerts",{"type":49,"value":463}," — synthetic alerts with MITRE ATT&CK mappings",{"type":43,"tag":453,"props":465,"children":466},{},[467,472],{"type":43,"tag":457,"props":468,"children":469},{},[470],{"type":49,"value":471},"Security > Attack Discovery",{"type":49,"value":473}," — requires an LLM connector to analyze alerts",{"type":43,"tag":453,"props":475,"children":476},{},[477,482],{"type":43,"tag":457,"props":478,"children":479},{},[480],{"type":49,"value":481},"Security > Hosts",{"type":49,"value":483}," — host activity from sample events",{"type":43,"tag":453,"props":485,"children":486},{},[487,492],{"type":43,"tag":457,"props":488,"children":489},{},[490],{"type":49,"value":491},"Security > Overview",{"type":49,"value":493}," — summary of all security data",{"type":43,"tag":453,"props":495,"children":496},{},[497,502],{"type":43,"tag":457,"props":498,"children":499},{},[500],{"type":49,"value":501},"Discover",{"type":49,"value":503}," — raw events across all data streams",{"type":43,"tag":116,"props":505,"children":507},{"id":506},"step-4-clean-up-when-done",[508],{"type":49,"value":509},"Step 4: Clean up when done",{"type":43,"tag":70,"props":511,"children":513},{"className":72,"code":512,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js --cleanup\n",[514],{"type":43,"tag":78,"props":515,"children":516},{"__ignoreMap":75},[517],{"type":43,"tag":82,"props":518,"children":519},{"class":84,"line":85},[520,524,528],{"type":43,"tag":82,"props":521,"children":522},{"style":89},[523],{"type":49,"value":92},{"type":43,"tag":82,"props":525,"children":526},{"style":95},[527],{"type":49,"value":286},{"type":43,"tag":82,"props":529,"children":530},{"style":95},[531],{"type":49,"value":532}," --cleanup\n",{"type":43,"tag":58,"props":534,"children":536},{"id":535},"what-gets-generated",[537],{"type":49,"value":538},"What gets generated",{"type":43,"tag":52,"props":540,"children":541},{},[542,544,550],{"type":49,"value":543},"Sample data spans 5 packages (system, endpoint, windows, aws, okta) and 4 focused attack scenarios covering the most\ncommon demo themes: Windows credential theft, AWS cloud privilege escalation, Okta identity takeover, and a full\nransomware kill chain. Synthetic alert documents are indexed into ",{"type":43,"tag":78,"props":545,"children":547},{"className":546},[],[548],{"type":49,"value":549},".alerts-security.alerts-default",{"type":49,"value":551}," with MITRE ATT&CK\nmappings, severity levels, and risk scores.",{"type":43,"tag":52,"props":553,"children":554},{},[555,557,563],{"type":49,"value":556},"All events use RFC 5737 \u002F RFC 2606 safe addresses. For full tables of packages, scenarios, and alerts see\n",{"type":43,"tag":558,"props":559,"children":561},"a",{"href":560},"references\u002Fsample-data-reference.md",[562],{"type":49,"value":560},{"type":49,"value":564},".",{"type":43,"tag":58,"props":566,"children":568},{"id":567},"continuous-mode",[569],{"type":49,"value":570},"Continuous mode",{"type":43,"tag":52,"props":572,"children":573},{},[574],{"type":49,"value":575},"Stream events to simulate a live environment:",{"type":43,"tag":70,"props":577,"children":579},{"className":72,"code":578,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  --continuous --interval 15\n",[580],{"type":43,"tag":78,"props":581,"children":582},{"__ignoreMap":75},[583,598],{"type":43,"tag":82,"props":584,"children":585},{"class":84,"line":85},[586,590,594],{"type":43,"tag":82,"props":587,"children":588},{"style":89},[589],{"type":49,"value":92},{"type":43,"tag":82,"props":591,"children":592},{"style":95},[593],{"type":49,"value":286},{"type":43,"tag":82,"props":595,"children":596},{"style":140},[597],{"type":49,"value":291},{"type":43,"tag":82,"props":599,"children":600},{"class":84,"line":167},[601,606,611],{"type":43,"tag":82,"props":602,"children":603},{"style":95},[604],{"type":49,"value":605},"  --continuous",{"type":43,"tag":82,"props":607,"children":608},{"style":95},[609],{"type":49,"value":610}," --interval",{"type":43,"tag":82,"props":612,"children":613},{"style":376},[614],{"type":49,"value":615}," 15\n",{"type":43,"tag":52,"props":617,"children":618},{},[619],{"type":49,"value":620},"Every 5th batch includes an attack scenario; every 10th batch adds synthetic alerts. Press Ctrl+C to stop.",{"type":43,"tag":58,"props":622,"children":624},{"id":623},"tool-reference",[625],{"type":49,"value":626},"Tool reference",{"type":43,"tag":116,"props":628,"children":630},{"id":629},"sample-datajs",[631],{"type":49,"value":632},"sample-data.js",{"type":43,"tag":634,"props":635,"children":636},"table",{},[637,656],{"type":43,"tag":638,"props":639,"children":640},"thead",{},[641],{"type":43,"tag":642,"props":643,"children":644},"tr",{},[645,651],{"type":43,"tag":646,"props":647,"children":648},"th",{},[649],{"type":49,"value":650},"Flag",{"type":43,"tag":646,"props":652,"children":653},{},[654],{"type":49,"value":655},"Description",{"type":43,"tag":657,"props":658,"children":659},"tbody",{},[660,686,703,720,737,754,771,788,812],{"type":43,"tag":642,"props":661,"children":662},{},[663,681],{"type":43,"tag":664,"props":665,"children":666},"td",{},[667,673,675],{"type":43,"tag":78,"props":668,"children":670},{"className":669},[],[671],{"type":49,"value":672},"--count",{"type":49,"value":674},", ",{"type":43,"tag":78,"props":676,"children":678},{"className":677},[],[679],{"type":49,"value":680},"-n",{"type":43,"tag":664,"props":682,"children":683},{},[684],{"type":49,"value":685},"Events per package (default: 50)",{"type":43,"tag":642,"props":687,"children":688},{},[689,698],{"type":43,"tag":664,"props":690,"children":691},{},[692],{"type":43,"tag":78,"props":693,"children":695},{"className":694},[],[696],{"type":49,"value":697},"--scenarios",{"type":43,"tag":664,"props":699,"children":700},{},[701],{"type":49,"value":702},"Run all attack simulation scenarios",{"type":43,"tag":642,"props":704,"children":705},{},[706,715],{"type":43,"tag":664,"props":707,"children":708},{},[709],{"type":43,"tag":78,"props":710,"children":712},{"className":711},[],[713],{"type":49,"value":714},"--scenario NAME",{"type":43,"tag":664,"props":716,"children":717},{},[718],{"type":49,"value":719},"Run a specific scenario",{"type":43,"tag":642,"props":721,"children":722},{},[723,732],{"type":43,"tag":664,"props":724,"children":725},{},[726],{"type":43,"tag":78,"props":727,"children":729},{"className":728},[],[730],{"type":49,"value":731},"--alerts",{"type":43,"tag":664,"props":733,"children":734},{},[735],{"type":49,"value":736},"Generate synthetic alert documents",{"type":43,"tag":642,"props":738,"children":739},{},[740,749],{"type":43,"tag":664,"props":741,"children":742},{},[743],{"type":43,"tag":78,"props":744,"children":746},{"className":745},[],[747],{"type":49,"value":748},"--cleanup",{"type":43,"tag":664,"props":750,"children":751},{},[752],{"type":49,"value":753},"Remove all sample data and alerts",{"type":43,"tag":642,"props":755,"children":756},{},[757,766],{"type":43,"tag":664,"props":758,"children":759},{},[760],{"type":43,"tag":78,"props":761,"children":763},{"className":762},[],[764],{"type":49,"value":765},"--continuous",{"type":43,"tag":664,"props":767,"children":768},{},[769],{"type":49,"value":770},"Stream live events (Ctrl+C to stop)",{"type":43,"tag":642,"props":772,"children":773},{},[774,783],{"type":43,"tag":664,"props":775,"children":776},{},[777],{"type":43,"tag":78,"props":778,"children":780},{"className":779},[],[781],{"type":49,"value":782},"--interval N",{"type":43,"tag":664,"props":784,"children":785},{},[786],{"type":49,"value":787},"Seconds between continuous batches (default: 30)",{"type":43,"tag":642,"props":789,"children":790},{},[791,807],{"type":43,"tag":664,"props":792,"children":793},{},[794,800,801],{"type":43,"tag":78,"props":795,"children":797},{"className":796},[],[798],{"type":49,"value":799},"--json",{"type":49,"value":674},{"type":43,"tag":78,"props":802,"children":804},{"className":803},[],[805],{"type":49,"value":806},"-j",{"type":43,"tag":664,"props":808,"children":809},{},[810],{"type":49,"value":811},"Output results as JSON",{"type":43,"tag":642,"props":813,"children":814},{},[815,831],{"type":43,"tag":664,"props":816,"children":817},{},[818,824,825],{"type":43,"tag":78,"props":819,"children":821},{"className":820},[],[822],{"type":49,"value":823},"--yes",{"type":49,"value":674},{"type":43,"tag":78,"props":826,"children":828},{"className":827},[],[829],{"type":49,"value":830},"-y",{"type":43,"tag":664,"props":832,"children":833},{},[834],{"type":49,"value":835},"Skip confirmation prompts",{"type":43,"tag":116,"props":837,"children":839},{"id":838},"demo-walkthroughjs",[840],{"type":49,"value":841},"demo-walkthrough.js",{"type":43,"tag":52,"props":843,"children":844},{},[845],{"type":49,"value":846},"Zero-friction runner that generates everything and opens Kibana.",{"type":43,"tag":634,"props":848,"children":849},{},[850,864],{"type":43,"tag":638,"props":851,"children":852},{},[853],{"type":43,"tag":642,"props":854,"children":855},{},[856,860],{"type":43,"tag":646,"props":857,"children":858},{},[859],{"type":49,"value":650},{"type":43,"tag":646,"props":861,"children":862},{},[863],{"type":49,"value":655},{"type":43,"tag":657,"props":865,"children":866},{},[867,883,899,915],{"type":43,"tag":642,"props":868,"children":869},{},[870,878],{"type":43,"tag":664,"props":871,"children":872},{},[873],{"type":43,"tag":78,"props":874,"children":876},{"className":875},[],[877],{"type":49,"value":748},{"type":43,"tag":664,"props":879,"children":880},{},[881],{"type":49,"value":882},"Remove all sample data, alerts, case",{"type":43,"tag":642,"props":884,"children":885},{},[886,894],{"type":43,"tag":664,"props":887,"children":888},{},[889],{"type":43,"tag":78,"props":890,"children":892},{"className":891},[],[893],{"type":49,"value":765},{"type":43,"tag":664,"props":895,"children":896},{},[897],{"type":49,"value":898},"Generate then stream live events",{"type":43,"tag":642,"props":900,"children":901},{},[902,911],{"type":43,"tag":664,"props":903,"children":904},{},[905],{"type":43,"tag":78,"props":906,"children":908},{"className":907},[],[909],{"type":49,"value":910},"--count N",{"type":43,"tag":664,"props":912,"children":913},{},[914],{"type":49,"value":685},{"type":43,"tag":642,"props":916,"children":917},{},[918,926],{"type":43,"tag":664,"props":919,"children":920},{},[921],{"type":43,"tag":78,"props":922,"children":924},{"className":923},[],[925],{"type":49,"value":782},{"type":43,"tag":664,"props":927,"children":928},{},[929],{"type":49,"value":930},"Seconds between batches (default: 30)",{"type":43,"tag":58,"props":932,"children":934},{"id":933},"examples",[935],{"type":49,"value":936},"Examples",{"type":43,"tag":116,"props":938,"children":940},{"id":939},"quick-demo-for-a-stakeholder",[941],{"type":49,"value":942},"Quick demo for a stakeholder",{"type":43,"tag":944,"props":945,"children":946},"blockquote",{},[947],{"type":43,"tag":52,"props":948,"children":949},{},[950],{"type":49,"value":951},"\"Set up a demo environment so I can show Attack Discovery to my VP.\"",{"type":43,"tag":70,"props":953,"children":954},{"className":72,"code":73,"language":74,"meta":75,"style":75},[955],{"type":43,"tag":78,"props":956,"children":957},{"__ignoreMap":75},[958],{"type":43,"tag":82,"props":959,"children":960},{"class":84,"line":85},[961,965],{"type":43,"tag":82,"props":962,"children":963},{"style":89},[964],{"type":49,"value":92},{"type":43,"tag":82,"props":966,"children":967},{"style":95},[968],{"type":49,"value":98},{"type":43,"tag":116,"props":970,"children":972},{"id":971},"targeted-scenario-testing",[973],{"type":49,"value":974},"Targeted scenario testing",{"type":43,"tag":944,"props":976,"children":977},{},[978],{"type":43,"tag":52,"props":979,"children":980},{},[981],{"type":49,"value":982},"\"Generate only the ransomware attack chain to test our detection rules.\"",{"type":43,"tag":70,"props":984,"children":986},{"className":72,"code":985,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fsample-data.js \\\n  --scenario ransomwareChain --alerts\n",[987],{"type":43,"tag":78,"props":988,"children":989},{"__ignoreMap":75},[990,1005],{"type":43,"tag":82,"props":991,"children":992},{"class":84,"line":85},[993,997,1001],{"type":43,"tag":82,"props":994,"children":995},{"style":89},[996],{"type":49,"value":92},{"type":43,"tag":82,"props":998,"children":999},{"style":95},[1000],{"type":49,"value":286},{"type":43,"tag":82,"props":1002,"children":1003},{"style":140},[1004],{"type":49,"value":291},{"type":43,"tag":82,"props":1006,"children":1007},{"class":84,"line":167},[1008,1013,1018],{"type":43,"tag":82,"props":1009,"children":1010},{"style":95},[1011],{"type":49,"value":1012},"  --scenario",{"type":43,"tag":82,"props":1014,"children":1015},{"style":95},[1016],{"type":49,"value":1017}," ransomwareChain",{"type":43,"tag":82,"props":1019,"children":1020},{"style":95},[1021],{"type":49,"value":329},{"type":43,"tag":116,"props":1023,"children":1025},{"id":1024},"simulating-a-live-soc",[1026],{"type":49,"value":1027},"Simulating a live SOC",{"type":43,"tag":944,"props":1029,"children":1030},{},[1031],{"type":43,"tag":52,"props":1032,"children":1033},{},[1034],{"type":49,"value":1035},"\"Keep generating events so the dashboards stay active during the demo.\"",{"type":43,"tag":70,"props":1037,"children":1039},{"className":72,"code":1038,"language":74,"meta":75,"style":75},"node skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fdemo-walkthrough.js --continuous\n",[1040],{"type":43,"tag":78,"props":1041,"children":1042},{"__ignoreMap":75},[1043],{"type":43,"tag":82,"props":1044,"children":1045},{"class":84,"line":85},[1046,1050,1055],{"type":43,"tag":82,"props":1047,"children":1048},{"style":89},[1049],{"type":49,"value":92},{"type":43,"tag":82,"props":1051,"children":1052},{"style":95},[1053],{"type":49,"value":1054}," skills\u002Fsecurity\u002Fgenerate-security-sample-data\u002Fscripts\u002Fdemo-walkthrough.js",{"type":43,"tag":82,"props":1056,"children":1057},{"style":95},[1058],{"type":49,"value":1059}," --continuous\n",{"type":43,"tag":116,"props":1061,"children":1063},{"id":1062},"cleaning-up-after-a-demo",[1064],{"type":49,"value":1065},"Cleaning up after a demo",{"type":43,"tag":944,"props":1067,"children":1068},{},[1069],{"type":43,"tag":52,"props":1070,"children":1071},{},[1072],{"type":49,"value":1073},"\"Remove all sample data from my project.\"",{"type":43,"tag":70,"props":1075,"children":1076},{"className":72,"code":512,"language":74,"meta":75,"style":75},[1077],{"type":43,"tag":78,"props":1078,"children":1079},{"__ignoreMap":75},[1080],{"type":43,"tag":82,"props":1081,"children":1082},{"class":84,"line":85},[1083,1087,1091],{"type":43,"tag":82,"props":1084,"children":1085},{"style":89},[1086],{"type":49,"value":92},{"type":43,"tag":82,"props":1088,"children":1089},{"style":95},[1090],{"type":49,"value":286},{"type":43,"tag":82,"props":1092,"children":1093},{"style":95},[1094],{"type":49,"value":532},{"type":43,"tag":58,"props":1096,"children":1098},{"id":1097},"guidelines",[1099],{"type":49,"value":1100},"Guidelines",{"type":43,"tag":449,"props":1102,"children":1103},{},[1104,1117,1130,1142,1147],{"type":43,"tag":453,"props":1105,"children":1106},{},[1107,1109,1115],{"type":49,"value":1108},"All generated documents are tagged with ",{"type":43,"tag":78,"props":1110,"children":1112},{"className":1111},[],[1113],{"type":49,"value":1114},"tags: [\"elastic-security-sample-data\"]",{"type":49,"value":1116}," for safe cleanup. The cleanup command\nonly deletes documents with this marker.",{"type":43,"tag":453,"props":1118,"children":1119},{},[1120,1122,1128],{"type":49,"value":1121},"If marker fields are not indexed in a data stream, cleanup falls back to scanning ",{"type":43,"tag":78,"props":1123,"children":1125},{"className":1124},[],[1126],{"type":49,"value":1127},"_source.tags",{"type":49,"value":1129}," for matching sample\ndocuments from the last 14 days.",{"type":43,"tag":453,"props":1131,"children":1132},{},[1133,1135,1140],{"type":49,"value":1134},"Synthetic alerts are indexed directly into ",{"type":43,"tag":78,"props":1136,"children":1138},{"className":1137},[],[1139],{"type":49,"value":549},{"type":49,"value":1141}," — they do not require detection rules to\nbe installed or enabled.",{"type":43,"tag":453,"props":1143,"children":1144},{},[1145],{"type":49,"value":1146},"Attack Discovery requires an LLM connector (OpenAI, Anthropic, Google Gemini, or similar) configured in Kibana under\nStack Management > Connectors. The \"Complete\" project tier unlocks the feature, but the connector must be set up\nseparately.",{"type":43,"tag":453,"props":1148,"children":1149},{},[1150,1152,1158],{"type":49,"value":1151},"Use the ",{"type":43,"tag":78,"props":1153,"children":1155},{"className":1154},[],[1156],{"type":49,"value":1157},"case-management",{"type":49,"value":1159}," skill for creating investigation cases from alerts.",{"type":43,"tag":58,"props":1161,"children":1163},{"id":1162},"production-use",[1164],{"type":49,"value":1165},"Production use",{"type":43,"tag":449,"props":1167,"children":1168},{},[1169,1179,1218,1236],{"type":43,"tag":453,"props":1170,"children":1171},{},[1172,1177],{"type":43,"tag":457,"props":1173,"children":1174},{},[1175],{"type":49,"value":1176},"Do not run against production clusters",{"type":49,"value":1178}," unless you intend to inject synthetic data alongside real alerts. Sample\nevents and alerts are tagged for cleanup but will appear in dashboards, the Alerts tab, and Attack Discovery alongside\nreal data.",{"type":43,"tag":453,"props":1180,"children":1181},{},[1182,1184,1190,1191,1196,1197,1202,1204,1209,1211,1216],{"type":49,"value":1183},"All write operations (",{"type":43,"tag":78,"props":1185,"children":1187},{"className":1186},[],[1188],{"type":49,"value":1189},"generate",{"type":49,"value":674},{"type":43,"tag":78,"props":1192,"children":1194},{"className":1193},[],[1195],{"type":49,"value":748},{"type":49,"value":674},{"type":43,"tag":78,"props":1198,"children":1200},{"className":1199},[],[1201],{"type":49,"value":765},{"type":49,"value":1203},") prompt for confirmation. Pass ",{"type":43,"tag":78,"props":1205,"children":1207},{"className":1206},[],[1208],{"type":49,"value":823},{"type":49,"value":1210}," or ",{"type":43,"tag":78,"props":1212,"children":1214},{"className":1213},[],[1215],{"type":49,"value":830},{"type":49,"value":1217}," to skip\nwhen called by an agent.",{"type":43,"tag":453,"props":1219,"children":1220},{},[1221,1226,1228,1234],{"type":43,"tag":78,"props":1222,"children":1224},{"className":1223},[],[1225],{"type":49,"value":748},{"type":49,"value":1227}," runs ",{"type":43,"tag":78,"props":1229,"children":1231},{"className":1230},[],[1232],{"type":49,"value":1233},"deleteByQuery",{"type":49,"value":1235}," across all sample data indices — verify environment variables point to the intended\ncluster before running.",{"type":43,"tag":453,"props":1237,"children":1238},{},[1239,1244],{"type":43,"tag":78,"props":1240,"children":1242},{"className":1241},[],[1243],{"type":49,"value":765},{"type":49,"value":1245}," mode indexes events indefinitely until manually stopped with Ctrl+C.",{"type":43,"tag":58,"props":1247,"children":1249},{"id":1248},"environment-variables",[1250],{"type":49,"value":1251},"Environment variables",{"type":43,"tag":634,"props":1253,"children":1254},{},[1255,1275],{"type":43,"tag":638,"props":1256,"children":1257},{},[1258],{"type":43,"tag":642,"props":1259,"children":1260},{},[1261,1266,1271],{"type":43,"tag":646,"props":1262,"children":1263},{},[1264],{"type":49,"value":1265},"Variable",{"type":43,"tag":646,"props":1267,"children":1268},{},[1269],{"type":49,"value":1270},"Required",{"type":43,"tag":646,"props":1272,"children":1273},{},[1274],{"type":49,"value":655},{"type":43,"tag":657,"props":1276,"children":1277},{},[1278,1300,1322,1343,1364,1386,1407],{"type":43,"tag":642,"props":1279,"children":1280},{},[1281,1290,1295],{"type":43,"tag":664,"props":1282,"children":1283},{},[1284],{"type":43,"tag":78,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":49,"value":1289},"ELASTICSEARCH_URL",{"type":43,"tag":664,"props":1291,"children":1292},{},[1293],{"type":49,"value":1294},"Yes",{"type":43,"tag":664,"props":1296,"children":1297},{},[1298],{"type":49,"value":1299},"Elasticsearch URL",{"type":43,"tag":642,"props":1301,"children":1302},{},[1303,1312,1317],{"type":43,"tag":664,"props":1304,"children":1305},{},[1306],{"type":43,"tag":78,"props":1307,"children":1309},{"className":1308},[],[1310],{"type":49,"value":1311},"ELASTICSEARCH_API_KEY",{"type":43,"tag":664,"props":1313,"children":1314},{},[1315],{"type":49,"value":1316},"Yes*",{"type":43,"tag":664,"props":1318,"children":1319},{},[1320],{"type":49,"value":1321},"Elasticsearch API key",{"type":43,"tag":642,"props":1323,"children":1324},{},[1325,1334,1338],{"type":43,"tag":664,"props":1326,"children":1327},{},[1328],{"type":43,"tag":78,"props":1329,"children":1331},{"className":1330},[],[1332],{"type":49,"value":1333},"ELASTICSEARCH_USERNAME",{"type":43,"tag":664,"props":1335,"children":1336},{},[1337],{"type":49,"value":1316},{"type":43,"tag":664,"props":1339,"children":1340},{},[1341],{"type":49,"value":1342},"Elasticsearch username (alternative)",{"type":43,"tag":642,"props":1344,"children":1345},{},[1346,1355,1359],{"type":43,"tag":664,"props":1347,"children":1348},{},[1349],{"type":43,"tag":78,"props":1350,"children":1352},{"className":1351},[],[1353],{"type":49,"value":1354},"ELASTICSEARCH_PASSWORD",{"type":43,"tag":664,"props":1356,"children":1357},{},[1358],{"type":49,"value":1316},{"type":43,"tag":664,"props":1360,"children":1361},{},[1362],{"type":49,"value":1363},"Elasticsearch password (alternative)",{"type":43,"tag":642,"props":1365,"children":1366},{},[1367,1376,1381],{"type":43,"tag":664,"props":1368,"children":1369},{},[1370],{"type":43,"tag":78,"props":1371,"children":1373},{"className":1372},[],[1374],{"type":49,"value":1375},"KIBANA_URL",{"type":43,"tag":664,"props":1377,"children":1378},{},[1379],{"type":49,"value":1380},"No",{"type":43,"tag":664,"props":1382,"children":1383},{},[1384],{"type":49,"value":1385},"Kibana URL (for case creation and links)",{"type":43,"tag":642,"props":1387,"children":1388},{},[1389,1398,1402],{"type":43,"tag":664,"props":1390,"children":1391},{},[1392],{"type":43,"tag":78,"props":1393,"children":1395},{"className":1394},[],[1396],{"type":49,"value":1397},"KIBANA_USERNAME",{"type":43,"tag":664,"props":1399,"children":1400},{},[1401],{"type":49,"value":1380},{"type":43,"tag":664,"props":1403,"children":1404},{},[1405],{"type":49,"value":1406},"Kibana username (if using Kibana features)",{"type":43,"tag":642,"props":1408,"children":1409},{},[1410,1419,1423],{"type":43,"tag":664,"props":1411,"children":1412},{},[1413],{"type":43,"tag":78,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":49,"value":1418},"KIBANA_PASSWORD",{"type":43,"tag":664,"props":1420,"children":1421},{},[1422],{"type":49,"value":1380},{"type":43,"tag":664,"props":1424,"children":1425},{},[1426],{"type":49,"value":1427},"Kibana password (if using Kibana features)",{"type":43,"tag":52,"props":1429,"children":1430},{},[1431],{"type":49,"value":1432},"*Either API key or username\u002Fpassword is required for Elasticsearch.",{"type":43,"tag":1434,"props":1435,"children":1436},"style",{},[1437],{"type":49,"value":1438},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1440,"total":1606},[1441,1460,1477,1490,1507,1519,1529,1542,1554,1569,1580,1593],{"slug":1442,"name":1442,"fn":1443,"description":1444,"org":1445,"tags":1446,"stars":1457,"repoUrl":1458,"updatedAt":1459},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1447,1450,1453,1454],{"name":1448,"slug":1449,"type":15},"Analytics","analytics",{"name":1451,"slug":1452,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":1455,"slug":1456,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":1461,"name":1461,"fn":1462,"description":1463,"org":1464,"tags":1465,"stars":1457,"repoUrl":1458,"updatedAt":1476},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1466,1469,1470,1473],{"name":1467,"slug":1468,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":1471,"slug":1472,"type":15},"Engineering","engineering",{"name":1474,"slug":1475,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1478,"name":1478,"fn":1479,"description":1480,"org":1481,"tags":1482,"stars":1457,"repoUrl":1458,"updatedAt":1489},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1483,1484,1487,1488],{"name":9,"slug":8,"type":15},{"name":1485,"slug":1486,"type":15},"Elasticsearch","elasticsearch",{"name":1455,"slug":1456,"type":15},{"name":21,"slug":22,"type":15},"2026-07-12T07:46:37.277964",{"slug":1491,"name":1491,"fn":1492,"description":1493,"org":1494,"tags":1495,"stars":23,"repoUrl":24,"updatedAt":1506},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1496,1499,1500,1503],{"name":1497,"slug":1498,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":1501,"slug":1502,"type":15},"Operations","operations",{"name":1504,"slug":1505,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":1508,"name":1508,"fn":1509,"description":1510,"org":1511,"tags":1512,"stars":23,"repoUrl":24,"updatedAt":1518},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1513,1514,1517],{"name":1497,"slug":1498,"type":15},{"name":1515,"slug":1516,"type":15},"Deployment","deployment",{"name":1485,"slug":1486,"type":15},"2026-07-12T07:46:42.353362",{"slug":1520,"name":1520,"fn":1521,"description":1522,"org":1523,"tags":1524,"stars":23,"repoUrl":24,"updatedAt":1528},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1525,1526,1527],{"name":1497,"slug":1498,"type":15},{"name":1485,"slug":1486,"type":15},{"name":1501,"slug":1502,"type":15},"2026-07-12T07:46:41.097412",{"slug":1530,"name":1530,"fn":1531,"description":1532,"org":1533,"tags":1534,"stars":23,"repoUrl":24,"updatedAt":1541},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1535,1536,1537,1540],{"name":1497,"slug":1498,"type":15},{"name":1485,"slug":1486,"type":15},{"name":1538,"slug":1539,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":1543,"name":1543,"fn":1544,"description":1545,"org":1546,"tags":1547,"stars":23,"repoUrl":24,"updatedAt":1553},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1548,1551,1552],{"name":1549,"slug":1550,"type":15},"Authentication","authentication",{"name":1497,"slug":1498,"type":15},{"name":1485,"slug":1486,"type":15},"2026-07-12T07:46:39.783105",{"slug":1555,"name":1555,"fn":1556,"description":1557,"org":1558,"tags":1559,"stars":23,"repoUrl":24,"updatedAt":1568},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1560,1563,1564,1567],{"name":1561,"slug":1562,"type":15},"Audit","audit",{"name":1485,"slug":1486,"type":15},{"name":1565,"slug":1566,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":1570,"name":1570,"fn":1571,"description":1572,"org":1573,"tags":1574,"stars":23,"repoUrl":24,"updatedAt":1579},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1575,1576,1577,1578],{"name":1549,"slug":1550,"type":15},{"name":9,"slug":8,"type":15},{"name":1485,"slug":1486,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":1581,"name":1581,"fn":1582,"description":1583,"org":1584,"tags":1585,"stars":23,"repoUrl":24,"updatedAt":1592},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1586,1587,1588,1591],{"name":9,"slug":8,"type":15},{"name":1485,"slug":1486,"type":15},{"name":1589,"slug":1590,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":1594,"name":1594,"fn":1595,"description":1596,"org":1597,"tags":1598,"stars":23,"repoUrl":24,"updatedAt":1605},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1599,1600,1601,1602],{"name":1448,"slug":1449,"type":15},{"name":1451,"slug":1452,"type":15},{"name":1485,"slug":1486,"type":15},{"name":1603,"slug":1604,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":1608,"total":1655},[1609,1616,1622,1628,1635,1641,1648],{"slug":1491,"name":1491,"fn":1492,"description":1493,"org":1610,"tags":1611,"stars":23,"repoUrl":24,"updatedAt":1506},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1612,1613,1614,1615],{"name":1497,"slug":1498,"type":15},{"name":9,"slug":8,"type":15},{"name":1501,"slug":1502,"type":15},{"name":1504,"slug":1505,"type":15},{"slug":1508,"name":1508,"fn":1509,"description":1510,"org":1617,"tags":1618,"stars":23,"repoUrl":24,"updatedAt":1518},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1619,1620,1621],{"name":1497,"slug":1498,"type":15},{"name":1515,"slug":1516,"type":15},{"name":1485,"slug":1486,"type":15},{"slug":1520,"name":1520,"fn":1521,"description":1522,"org":1623,"tags":1624,"stars":23,"repoUrl":24,"updatedAt":1528},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1625,1626,1627],{"name":1497,"slug":1498,"type":15},{"name":1485,"slug":1486,"type":15},{"name":1501,"slug":1502,"type":15},{"slug":1530,"name":1530,"fn":1531,"description":1532,"org":1629,"tags":1630,"stars":23,"repoUrl":24,"updatedAt":1541},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1631,1632,1633,1634],{"name":1497,"slug":1498,"type":15},{"name":1485,"slug":1486,"type":15},{"name":1538,"slug":1539,"type":15},{"name":13,"slug":14,"type":15},{"slug":1543,"name":1543,"fn":1544,"description":1545,"org":1636,"tags":1637,"stars":23,"repoUrl":24,"updatedAt":1553},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1638,1639,1640],{"name":1549,"slug":1550,"type":15},{"name":1497,"slug":1498,"type":15},{"name":1485,"slug":1486,"type":15},{"slug":1555,"name":1555,"fn":1556,"description":1557,"org":1642,"tags":1643,"stars":23,"repoUrl":24,"updatedAt":1568},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1644,1645,1646,1647],{"name":1561,"slug":1562,"type":15},{"name":1485,"slug":1486,"type":15},{"name":1565,"slug":1566,"type":15},{"name":13,"slug":14,"type":15},{"slug":1570,"name":1570,"fn":1571,"description":1572,"org":1649,"tags":1650,"stars":23,"repoUrl":24,"updatedAt":1579},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1651,1652,1653,1654],{"name":1549,"slug":1550,"type":15},{"name":9,"slug":8,"type":15},{"name":1485,"slug":1486,"type":15},{"name":13,"slug":14,"type":15},35]