47 lines
1.8 KiB
Python
47 lines
1.8 KiB
Python
#!/usr/bin/env python3
|
|
"""Emit synthetic Windows Security-style JSONL events for Graylog/Filebeat testing."""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import random
|
|
import time
|
|
from datetime import UTC, datetime
|
|
from pathlib import Path
|
|
|
|
|
|
EVENTS = [4624, 4625, 4634, 4672, 4688]
|
|
USERS = ["alice", "bob", "svc_backup", "administrator"]
|
|
HOSTS = ["WIN-CLIENT-01", "WIN-CLIENT-02", "WIN-SRV-01"]
|
|
|
|
|
|
def event() -> dict[str, object]:
|
|
event_id = random.choices(EVENTS, weights=[45, 25, 15, 5, 10])[0]
|
|
failed = event_id == 4625
|
|
return {
|
|
"timestamp": datetime.now(UTC).isoformat(), "event_id": event_id,
|
|
"user": random.choice(USERS), "hostname": random.choice(HOSTS),
|
|
"source_ip": f"192.168.1.{random.randint(20, 90)}", "logon_type": random.choice([2, 3, 10]),
|
|
"status": "failure" if failed else "success", "action": "deny" if failed else "accept",
|
|
"event_provider": "Microsoft-Windows-Security-Auditing", "stream_hint": "Windows", "synthetic": True,
|
|
"message": "Synthetic Windows Security event generated by SignalScope test harness",
|
|
}
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--output", default="logs/windows-synthetic.jsonl")
|
|
parser.add_argument("--interval", type=float, default=1.0)
|
|
parser.add_argument("--count", type=int, default=0, help="0 runs until interrupted")
|
|
args = parser.parse_args()
|
|
path = Path(args.output); path.parent.mkdir(parents=True, exist_ok=True)
|
|
emitted = 0
|
|
with path.open("a", encoding="utf-8", buffering=1) as handle:
|
|
while not args.count or emitted < args.count:
|
|
handle.write(json.dumps(event()) + "\n"); emitted += 1; time.sleep(args.interval)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|