README

EvidenceForge


  
    
    
    
  






Generate realistic synthetic security logs for cybersecurity threat hunting training and research.

For background on the project and why we built it, read our announcement:
Introducing EvidenceForge: synthetic security logs that don't look (as) fake.

 What It Does

EvidenceForge creates multi-format security log datasets from YAML scenario definitions. You
describe an environment—users, systems, network topology, and normal activity—and an optional
attack storyline. EvidenceForge then generates temporally consistent evidence across all selected
formats, complete with cross-referenced identities, sessions, processes, timestamps, and network
connections.

Every generated bundle includes human-readable GROUND_TRUTH.md and machine-readable
GROUND_TRUTH.json answer keys. Attack scenarios document what happened, when, and where, while
baseline-only scenarios explicitly state that no malicious events were generated.

 Key Capabilities

- Guided scenario authoring — Agent skills turn exercise ideas into validated scenario
  definitions, environment briefings, reusable packs, and configuration changes.
- Multi-source evidence generation — Produce Windows, Linux, EDR, network, IDS, firewall, web,
  proxy, and email evidence from one scenario.
- Baseline and storyline modeling — Combine ordinary user and system activity, benign red
  herrings, and typed attack events in the same dataset.
- Repeatable generation at scale — Deterministic seeds, resource forecasts, progress reporting,
  and resumable checkpoints support complex simulations and huge datasets.
- Validation and quality measurement — Catch schema, cross-reference, topology, and capacity
  problems before generation, then evaluate the resulting evidence across four quality pillars.
- Reusable environment modeling — Split scenarios with YAML includes, compose versioned
  industry or organization packs, and apply project-local configuration overlays.

 What Makes EvidenceForge Different

Most synthetic log generators create independent rows or replay isolated templates. EvidenceForge
models activities first, then renders the evidence those activities would leave across different
systems and sensors.

- Correlated evidence, not independent rows. A logon, process, file operation, or connection
  retains the same identities and relationships everywhere it is observed, enabling realistic
  pivots between endpoint, identity, network, and application sources.
- Causal activity, not keyword matching. DNS lookups precede connections, Kerberos tickets
  precede domain logons, and lifecycle endings follow their beginnings. Required supporting
  evidence is generated automatically instead of being hand-authored as disconnected events.
- Behavioral and temporal realism. Bursty user activity, periodic system traffic with jitter,
  day-of-week variation, role-aware services, and benign anomalies create the texture analysts
  expect from real environments.
- Observation-

Top issues

Latest release

What's Changed
 chore: avoid duplicate dev CI runs by @DavidJBianco in https://github.com/Cisco-Talos/EvidenceForge/pull/424
 chore: release v2.1.2 by @DavidJBianco in https://github.com/Cisco-Talos/EvidenceForge/pull/429


Full Changelog: https://github.com/Cisco-Talos/EvidenceForge/compare/v2.1.1...v2.1.2