bokamba / loganvil / Windows Security Event logs

$ loganvil generate windows-event

Generate synthetic Windows Security Event logs

Generate realistic synthetic Windows Security Event logs (key=value) for pipeline testing, SIEM demos, and detection tuning — deterministic and 100% client-side. Each line carries the Security-log fields — EventID (4624/4625/4634/4740/4771), TargetUserName, LogonType, IpAddress, IpPort, Status, WorkstationName — so it exercises your Windows-event parser exactly. No real accounts or secrets.

Open the LogAnvil generator →

This sample, generated

The block below is 15 lines of Windows Security Event logs, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

15lines
4.6stime span
0anomaly lines
42seed

no anomalies injected — raise a slider to seed detectable patterns

Generated Windows Security Event logs

Real on-the-wire Windows Security Event logs — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

EventID=4740 TargetUserName=frank LogonType=10 IpAddress=10.1.10.200 IpPort=47634 Status=0xC0000064 WorkstationName=LAPTOP-ZX9CV2B
EventID=4634 TargetUserName=dave LogonType=10 IpAddress=1.1.1.1 IpPort=46904 Status=0x0 WorkstationName=LAPTOP-ZX9CV2B
EventID=4634 TargetUserName=www-data LogonType=2 IpAddress=10.0.0.5 IpPort=40304 Status=0xC000006D WorkstationName=DESKTOP-A1B2C3D
EventID=4634 TargetUserName=alice LogonType=3 IpAddress=185.199.108.153 IpPort=41787 Status=0xC0000064 WorkstationName=DESKTOP-A1B2C3D
EventID=4634 TargetUserName=svc-deploy LogonType=4 IpAddress=10.1.10.200 IpPort=41340 Status=0x0 WorkstationName=LAPTOP-M4N5B6V
EventID=4624 TargetUserName=dave LogonType=4 IpAddress=192.168.0.101 IpPort=51987 Status=0x0 WorkstationName=LAPTOP-M4N5B6V
EventID=4771 TargetUserName=frank LogonType=11 IpAddress=10.0.1.24 IpPort=33215 Status=0xC0000064 WorkstationName=DESKTOP-QW3RTY8
EventID=4771 TargetUserName=bob LogonType=9 IpAddress=34.223.14.100 IpPort=37839 Status=0x0 WorkstationName=LAPTOP-M4N5B6V
EventID=4771 TargetUserName=svc-deploy LogonType=11 IpAddress=172.20.0.15 IpPort=42281 Status=0x0 WorkstationName=DESKTOP-7GH9KLM
EventID=4624 TargetUserName=frank LogonType=10 IpAddress=192.168.100.254 IpPort=57900 Status=0xC0000064 WorkstationName=DESKTOP-QW3RTY8
EventID=4625 TargetUserName=postgres LogonType=5 IpAddress=192.0.2.1 IpPort=46189 Status=0xC000006A WorkstationName=DESKTOP-A1B2C3D
EventID=4625 TargetUserName=postgres LogonType=8 IpAddress=172.16.4.9 IpPort=37382 Status=0x0 WorkstationName=DESKTOP-7GH9KLM
EventID=4740 TargetUserName=admin LogonType=5 IpAddress=1.1.1.1 IpPort=57152 Status=0xC0000064 WorkstationName=DESKTOP-A1B2C3D
EventID=4740 TargetUserName=admin LogonType=11 IpAddress=192.168.0.101 IpPort=46580 Status=0xC000006D WorkstationName=DESKTOP-A1B2C3D
EventID=4740 TargetUserName=dave LogonType=4 IpAddress=10.0.0.5 IpPort=39004 Status=0xC000006A WorkstationName=DESKTOP-QW3RTY8

With an anomaly injected: SSH brute-force

The same source, regenerated with a SSH brute-force injected at 30% intensity. 6 line sare tagged and highlighted below — A burst of failed logins from one source IP, then a success — the classic credential-stuffing signature. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

EventID=4740 TargetUserName=frank LogonType=10 IpAddress=10.1.10.200 IpPort=47634 Status=0xC0000064 WorkstationName=LAPTOP-ZX9CV2B
EventID=4634 TargetUserName=dave LogonType=10 IpAddress=1.1.1.1 IpPort=46904 Status=0x0 WorkstationName=LAPTOP-ZX9CV2B
EventID=4634 TargetUserName=www-data LogonType=2 IpAddress=10.0.0.5 IpPort=40304 Status=0xC000006D WorkstationName=DESKTOP-A1B2C3D
EventID=4634 TargetUserName=alice LogonType=3 IpAddress=185.199.108.153 IpPort=41787 Status=0xC0000064 WorkstationName=DESKTOP-A1B2C3D
EventID=4634 TargetUserName=svc-deploy LogonType=4 IpAddress=10.1.10.200 IpPort=41340 Status=0x0 WorkstationName=LAPTOP-M4N5B6V
EventID=4624 TargetUserName=dave LogonType=4 IpAddress=192.168.0.101 IpPort=51987 Status=0x0 WorkstationName=LAPTOP-M4N5B6V
EventID=4771 TargetUserName=frank LogonType=11 IpAddress=10.0.1.24 IpPort=33215 Status=0xC0000064 WorkstationName=DESKTOP-QW3RTY8
EventID=4771 TargetUserName=bob LogonType=9 IpAddress=34.223.14.100 IpPort=37839 Status=0x0 WorkstationName=LAPTOP-M4N5B6V
Failed password for oracle from 80.82.77.139 port 60124 ssh2SSH brute-force
Failed password for oracle from 80.82.77.139 port 60124 ssh2SSH brute-force
Failed password for oracle from 80.82.77.139 port 60124 ssh2SSH brute-force
Failed password for oracle from 80.82.77.139 port 60124 ssh2SSH brute-force
Failed password for oracle from 80.82.77.139 port 60124 ssh2SSH brute-force
Accepted password for oracle from 80.82.77.139 port 60124 ssh2SSH brute-force

FAQ

Are these real Windows Security events?
No — the output is synthetic. It reproduces the Windows Security key=value event fields (EventID, TargetUserName, LogonType, IpAddress, Status, WorkstationName), but every account, host and address is fabricated. Safe for fixtures, demos and parser tests.
Can I inject anomalies?
Yes. An SSH brute-force / credential-stuffing burst maps cleanly onto repeated logon failures (4625) then a success — the slider appends that pattern and the injected lines are highlighted and badged so you can prove your account-attack rule fires.
Is the output deterministic?
Yes — fully seeded. The same seed and config always produce byte-identical Windows event lines, so a committed seed regenerates the exact same log anywhere.

Generate other log sources

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.

Generate your own Windows Security Event logs

Pick the seed, line count and EPS, inject the anomalies your rules should catch, and copy or download the result. Free, no account, nothing uploaded — generation runs entirely in your browser.

Open the LogAnvil generator →