Security Generate Security Sample Data

#!/usr/bin/env node
/**
 * Zero-friction sample data runner.
 *
 * Usage:
 *   node demo-walkthrough.js              # Generate everything once
 *   node demo-walkthrough.js --continuous  # Keep streaming events
 *   node demo-walkthrough.js --cleanup     # Remove all sample data
 */

import { exec } from "node:child_process";
import { testConnection as testEsConnection } from "./es-client.js";
import { testConnection as testKibanaConnection } from "./kibana-client.js";
import { kibanaGet, kibanaPost } from "./kibana-client.js";
import {
  generateAndIndex,
  runAttackScenarios,
  generateAlerts,
  generateCase,
  cleanup,
  runContinuous,
  SUPPORTED_PACKAGES,
} from "./sample-data.js";

function openBrowser(url) {
  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
  exec(`${cmd} "${url}"`);
}

function printKibanaLinks() {
  const kibanaUrl = process.env.KIBANA_URL;
  if (!kibanaUrl) return;
  console.log("\n  Explore in Kibana:\n");
  console.log(`    Alerts:           ${kibanaUrl}/app/security/alerts`);
  console.log(`    Attack Discovery: ${kibanaUrl}/app/security/attack_discovery`);
  console.log(`    Cases:            ${kibanaUrl}/app/security/cases`);
  console.log(`    Hosts:            ${kibanaUrl}/app/security/hosts`);
  console.log(`    Overview:         ${kibanaUrl}/app/security/overview`);
}

async function checkEnv() {
  const hasES = process.env.ELASTICSEARCH_URL || process.env.ELASTICSEARCH_CLOUD_ID;
  const hasKibana = process.env.KIBANA_URL;
  const hasAuth =
    process.env.ELASTICSEARCH_API_KEY || (process.env.ELASTICSEARCH_USERNAME && process.env.ELASTICSEARCH_PASSWORD);

  if (!hasES || !hasAuth) {
    console.error("Missing environment variables. Set these before running:\n");
    console.error("  export ELASTICSEARCH_URL='https://your-project.es.region.aws.elastic.cloud'");
    console.error("  export KIBANA_URL='https://your-project.kb.region.aws.elastic.cloud'");
    console.error("  export ELASTICSEARCH_USERNAME='admin'");
    console.error("  export ELASTICSEARCH_PASSWORD='your-password'");
    process.exit(1);
  }

  console.log("Checking connections...");
  const esOk = await testEsConnection();
  if (!esOk) {
    console.error("Elasticsearch connection failed. Check your credentials.");
    process.exit(1);
  }

  if (hasKibana) {
    const kibanaOk = await testKibanaConnection();
    if (!kibanaOk) console.log("  Kibana connection failed — case won't be created, but events/alerts will work.");
  }
}

async function generate(count) {
  console.log(`\n--- Sample Events (${count} per package) ---\n`);
  const { totalIndexed, totalErrors } = await generateAndIndex([...SUPPORTED_PACKAGES], count);
  console.log(`  ${totalIndexed} events indexed, ${totalErrors} errors`);

  console.log("\n--- Attack Scenarios ---\n");
  const scenarioResult = await runAttackScenarios([]);
  console.log(`  ${scenarioResult.totalIndexed} scenario events indexed`);

  console.log("\n--- Synthetic Alerts ---\n");
  const alertResult = await generateAlerts([]);
  console.log(`  ${alertResult.totalIndexed} alerts indexed`);

  if (process.env.KIBANA_URL) {
    console.log("\n--- Investigation Case ---\n");
    try {
      await generateCase(kibanaPost, kibanaGet, alertResult.alertRefs || []);
    } catch (e) {
      console.error(`  Case skipped: ${e.message}`);
    }
  }

  const total = totalIndexed + scenarioResult.totalIndexed + alertResult.totalIndexed;
  console.log(`\nDone: ${total} total documents indexed.`);

  printKibanaLinks();

  if (process.env.KIBANA_URL) {
    openBrowser(`${process.env.KIBANA_URL}/app/security/alerts`);
    console.log("\n  Opened Security > Alerts in your browser.");
  }
}

async function main() {
  const argv = process.argv.slice(2);
  const doCleanup = argv.includes("--cleanup");
  const continuous = argv.includes("--continuous");
  const countArg = argv.find((_, i) => argv[i - 1] === "--count" || argv[i - 1] === "-n");
  const count = parseInt(countArg, 10) || 50;
  const intervalArg = argv.find((_, i) => argv[i - 1] === "--interval");
  const interval = parseInt(intervalArg, 10) || 30;

  console.log("");
  console.log("  Elastic Security — Sample Data Generator");
  console.log("  =========================================\n");

  await checkEnv();

  if (doCleanup) {
    console.log("");
    await cleanup();
    console.log("\nAll sample data removed.");
    return;
  }

  if (continuous) {
    console.log(`\nStarting continuous mode (every ${interval}s, Ctrl+C to stop)...\n`);
    await generate(count);
    console.log("\nSwitching to continuous stream...\n");
    await runContinuous(interval, 10);
    return;
  }

  await generate(count);
}

main().catch((e) => {
  console.error(e.message || e);
  process.exit(1);
});

/**
 * Elasticsearch client factory for SOC skills.
 * Supports Cloud ID, direct URL, API key, and basic auth.
 */

import { Client } from "@elastic/elasticsearch";

try {
  process.loadEnvFile();
} catch {}

/**
 * Create and return an Elasticsearch client using environment variables.
 */
export function createClient() {
  const cloudId = process.env.ELASTICSEARCH_CLOUD_ID;
  const apiKey = process.env.ELASTICSEARCH_API_KEY;
  const url = process.env.ELASTICSEARCH_URL;
  const username = process.env.ELASTICSEARCH_USERNAME;
  const password = process.env.ELASTICSEARCH_PASSWORD;
  const insecure = process.env.ELASTICSEARCH_INSECURE === "true";

  const config = {};

  if (cloudId) {
    config.cloud = { id: cloudId };
  } else if (url) {
    config.node = url;
  } else {
    console.error("Error: No Elasticsearch connection configured.");
    console.error("Set ELASTICSEARCH_CLOUD_ID or ELASTICSEARCH_URL environment variable.");
    process.exit(1);
  }

  if (apiKey) {
    config.auth = { apiKey };
  } else if (username && password) {
    config.auth = { username, password };
  } else if (username || password) {
    console.error("Error: Both ELASTICSEARCH_USERNAME and ELASTICSEARCH_PASSWORD must be set for basic auth.");
    process.exit(1);
  }

  if (insecure) {
    config.tls = { rejectUnauthorized: false };
  }

  config.headers = { "User-Agent": "elastic-agentic" };

  return new Client(config);
}

export async function testConnection() {
  try {
    const client = createClient();
    const info = await client.info();
    console.log(`Connected to Elasticsearch cluster: ${info.cluster_name}`);
    console.log(`Version: ${info.version.number}`);
    await client.close();
    return true;
  } catch (error) {
    console.error(`Connection failed: ${error.message}`);
    return false;
  }
}

/**
 * Lightweight HTTP client for the Kibana REST API.
 * Uses native fetch() with auth, retry on 429, and space support.
 */

try {
  process.loadEnvFile();
} catch {}

const RETRY_DELAYS = [5, 10, 20];

export function getKibanaConfig() {
  const url = process.env.KIBANA_URL;
  const apiKey = process.env.KIBANA_API_KEY;
  const username = process.env.KIBANA_USERNAME || process.env.ELASTICSEARCH_USERNAME;
  const password = process.env.KIBANA_PASSWORD || process.env.ELASTICSEARCH_PASSWORD;
  const spaceId = process.env.KIBANA_SPACE_ID;
  const insecure = process.env.KIBANA_INSECURE === "true";

  if (!url) {
    console.error("Error: No Kibana connection configured.");
    console.error("Set KIBANA_URL environment variable.");
    process.exit(1);
  }

  if (!apiKey && !username && !password && process.env.KIBANA_NO_AUTH !== "true") {
    console.error("Error: No Kibana authentication configured.");
    console.error("Set KIBANA_API_KEY or KIBANA_USERNAME + KIBANA_PASSWORD.");
    console.error("Or set KIBANA_NO_AUTH=true for clusters with security disabled.");
    process.exit(1);
  }

  if (!apiKey && ((username && !password) || (!username && password))) {
    console.error("Error: Both username and password must be set for basic auth.");
    console.error("Set KIBANA_USERNAME + KIBANA_PASSWORD (or ELASTICSEARCH_USERNAME + ELASTICSEARCH_PASSWORD).");
    process.exit(1);
  }

  return { url, apiKey, username, password, spaceId, insecure };
}

function getHeaders(config) {
  const headers = {
    "Content-Type": "application/json",
    "kbn-xsrf": "true",
    "User-Agent": "elastic-agentic",
  };

  if (config.apiKey) {
    headers["Authorization"] = `ApiKey ${config.apiKey}`;
  } else if (config.username && config.password) {
    const auth = Buffer.from(`${config.username}:${config.password}`).toString("base64");
    headers["Authorization"] = `Basic ${auth}`;
  }

  return headers;
}

function getBasePath(config, space) {
  let basePath = config.url.replace(/\/$/, "");
  const effectiveSpace = space || config.spaceId;
  if (effectiveSpace && effectiveSpace !== "default") {
    basePath += `/s/${effectiveSpace}`;
  }
  return basePath;
}

/**
 * Make an HTTP request to the Kibana API with automatic 429 retry.
 *
 * @param {string} path - API path (e.g. "/api/cases")
 * @param {object} [options] - fetch options (method, body, headers, params)
 * @param {string} [options.space] - Override Kibana space for this request
 * @returns {{ success: boolean, data?: any, status?: number, error?: string }}
 */
export async function kibanaFetch(path, options = {}) {
  const config = getKibanaConfig();
  const { space, params, ...fetchOpts } = options;
  const basePath = getBasePath(config, space);

  let url = `${basePath}${path}`;
  if (params) {
    const searchParams = new URLSearchParams();
    for (const [key, value] of Object.entries(params)) {
      if (value !== undefined && value !== null) {
        if (Array.isArray(value)) {
          for (const v of value) searchParams.append(key, v);
        } else {
          searchParams.append(key, String(value));
        }
      }
    }
    const qs = searchParams.toString();
    if (qs) url += `?${qs}`;
  }

  const requestOptions = {
    ...fetchOpts,
    headers: {
      ...getHeaders(config),
      ...fetchOpts.headers,
    },
  };

  if (config.insecure) {
    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
  }

  for (let attempt = 0; attempt <= RETRY_DELAYS.length; attempt++) {
    try {
      const response = await fetch(url, requestOptions);

      if (response.status === 429 && attempt < RETRY_DELAYS.length) {
        const delay = RETRY_DELAYS[attempt];
        console.error(`Rate limited, retrying in ${delay}s (attempt ${attempt + 1}/${RETRY_DELAYS.length + 1})...`);
        await new Promise((r) => setTimeout(r, delay * 1000));
        continue;
      }

      const contentType = response.headers.get("content-type");
      let data;
      if (contentType && contentType.includes("application/json")) {
        data = await response.json();
      } else {
        data = await response.text();
      }

      if (!response.ok) {
        return {
          success: false,
          status: response.status,
          error: data?.message || data?.error || `HTTP ${response.status}`,
          details: data,
        };
      }

      return { success: true, data };
    } catch (error) {
      if (attempt < RETRY_DELAYS.length && error.message?.includes("429")) {
        const delay = RETRY_DELAYS[attempt];
        console.error(`Rate limited, retrying in ${delay}s...`);
        await new Promise((r) => setTimeout(r, delay * 1000));
        continue;
      }
      return { success: false, error: error.message, details: error };
    }
  }
}

/**
 * Convenience wrappers matching the Python KibanaClient interface.
 * These throw on HTTP errors (matching the old behavior where scripts
 * relied on exceptions for error handling).
 */
export async function kibanaGet(path, params, space) {
  const result = await kibanaFetch(path, { method: "GET", params, space });
  if (!result.success) throw new Error(result.error || `HTTP ${result.status}`);
  return result.data;
}

export async function kibanaPost(path, body, space) {
  const result = await kibanaFetch(path, {
    method: "POST",
    body: body !== undefined ? JSON.stringify(body) : undefined,
    space,
  });
  if (!result.success) throw new Error(result.error || `HTTP ${result.status}`);
  return result.data;
}

export async function kibanaPatch(path, body, space) {
  const result = await kibanaFetch(path, {
    method: "PATCH",
    body: body !== undefined ? JSON.stringify(body) : undefined,
    space,
  });
  if (!result.success) throw new Error(result.error || `HTTP ${result.status}`);
  return result.data;
}

export async function kibanaPut(path, body, space) {
  const result = await kibanaFetch(path, {
    method: "PUT",
    body: body !== undefined ? JSON.stringify(body) : undefined,
    space,
  });
  if (!result.success) throw new Error(result.error || `HTTP ${result.status}`);
  return result.data;
}

export async function kibanaDelete(path, space) {
  const result = await kibanaFetch(path, { method: "DELETE", space });
  if (!result.success) throw new Error(result.error || `HTTP ${result.status}`);
  return result.data;
}

export async function testConnection(space) {
  try {
    const status = await kibanaGet("/api/status", undefined, space);
    const version = status?.version;
    const versionStr = typeof version === "object" ? version?.number : version;
    console.log(`Connected to Kibana: ${status?.name || "unknown"}`);
    console.log(`Version: ${versionStr || "unknown"}`);
    return true;
  } catch (error) {
    console.error(`Connection failed: ${error.message}`);
    return false;
  }
}