add filebeat sned test logs

scripts/generate_windows_events.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Emit synthetic Windows Security-style JSONL events for Graylog/Filebeat testing."""
+from __future__ import annotations
+
+import argparse
+import json
+import random
+import time
+from datetime import UTC, datetime
+from pathlib import Path
+
+
+EVENTS = [4624, 4625, 4634, 4672, 4688]
+USERS = ["alice", "bob", "svc_backup", "administrator"]
+HOSTS = ["WIN-CLIENT-01", "WIN-CLIENT-02", "WIN-SRV-01"]
+
+
+def event() -> dict[str, object]:
+    event_id = random.choices(EVENTS, weights=[45, 25, 15, 5, 10])[0]
+    failed = event_id == 4625
+    return {
+        "timestamp": datetime.now(UTC).isoformat(), "event_id": event_id,
+        "user": random.choice(USERS), "hostname": random.choice(HOSTS),
+        "source_ip": f"192.168.1.{random.randint(20, 90)}", "logon_type": random.choice([2, 3, 10]),
+        "status": "failure" if failed else "success", "action": "deny" if failed else "accept",
+        "event_provider": "Microsoft-Windows-Security-Auditing", "stream_hint": "Windows", "synthetic": True,
+        "message": "Synthetic Windows Security event generated by SignalScope test harness",
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--output", default="logs/windows-synthetic.jsonl")
+    parser.add_argument("--interval", type=float, default=1.0)
+    parser.add_argument("--count", type=int, default=0, help="0 runs until interrupted")
+    args = parser.parse_args()
+    path = Path(args.output); path.parent.mkdir(parents=True, exist_ok=True)
+    emitted = 0
+    with path.open("a", encoding="utf-8", buffering=1) as handle:
+        while not args.count or emitted < args.count:
+            handle.write(json.dumps(event()) + "\n"); emitted += 1; time.sleep(args.interval)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())