Synthetic Cybersecurity Data Generator by NEATLABS™ | Security 360, LLC | Service-Disabled Veteran-Owned Small Business
Generate realistic synthetic cybersecurity data for SOC training, SIEM rule development, CMMC audit prep, red team simulations, and AI/ML model training — entirely offline, zero external dependencies for the core library.
Screenshot: (add screenshot of the running GUI here)
- 88 data types across 8 categories — network, Windows, Linux, macOS, cloud, threat intel, CMMC, corporate
- 6 coherent attack scenarios — records that share a consistent attacker IP, victim host, malware family, and advancing timestamps across the full kill chain
- 8 export formats — JSON, CSV, NDJSON, SQL INSERT, XML, Raw Log, HTML Report
- CLI + GUI — full CustomTkinter desktop app or headless pipeline mode
- Optional GPT-4.1-nano enrichment — add analyst notes, MITRE ATT&CK annotations, and recommendations via the OpenAI API
- Reproducible output — seed support for deterministic data
- Zero required dependencies — core library runs on Python stdlib only
- Download and unzip
synthforge_vX.X.X.zip - Open a terminal / PowerShell in the unzipped folder (the one containing
run.py) - Run:
python run.py
That's it. No pip install needed for the core app.
Optional — better-looking UI:
pip install customtkinter
python run.py
Optional — GPT enrichment:
pip install openai
Then paste your OpenAI API key into the field in the right panel.
CLI mode:
python run.py --cli --list-types
python run.py --cli --type "Sysmon Events" --count 100 --format json
python run.py --cli --scenario "APT Intrusion Campaign" --count 50
Install as a proper Python package (optional):
pip install -e .
python -m synthforge# List all data types
python -m synthforge --cli --list-types
# Generate 100 Sysmon events as JSON
python -m synthforge --cli --type "Sysmon Events" --count 100
# Generate 500 records as CSV, saved to file
python -m synthforge --cli --type "Firewall Logs – Cisco ASA" --count 500 \
--format csv --output cisco_asa.csv
# Generate a coherent APT scenario (50 records across all kill-chain phases)
python -m synthforge --cli --scenario "APT Intrusion Campaign" --count 50
# List available scenarios
python -m synthforge --cli --list-scenarios
# Reproducible output with seed
python -m synthforge --cli --type "AWS CloudTrail Events" --count 25 \
--seed 42 --format ndjsonfrom synthforge import generate_records, generate_scenario, do_export
# Generate records
records = generate_records("Sysmon Events", 100)
# Generate coherent attack scenario
scenario_records = generate_scenario("APT Intrusion Campaign", 50)
# Export to any format
json_output = do_export(records, "Sysmon Events", "JSON")
csv_output = do_export(records, "Sysmon Events", "CSV")
raw_output = do_export(records, "Sysmon Events", "Raw Log Format")| Category | Icon | Types |
|---|---|---|
| Network Traffic | 📡 | PCAP, NetFlow, Snort/Suricata, iptables, Cisco ASA, Palo Alto, Fortinet, pfSense, Cisco IOS, Juniper, DNS, DHCP, Squid, VPN, BGP (+2) |
| Windows Artifacts | 🪟 | Security EVTX, System/App Event Log, Sysmon, PowerShell, Defender, Firewall, Scheduled Tasks, Registry, Prefetch, MFT, Browser History, LSASS |
| Linux Log Artifacts | 🐧 | auth.log, syslog, kern.log, Apache2, Nginx, auditd, SSH, Cron, Bash History, sudo, iptables, fail2ban, PAM |
| macOS Log Artifacts | 🍎 | Unified Logs, system.log, Security Framework, mDNSResponder, LaunchDaemon, Spotlight, FSEvents, Safari, Terminal |
| Cybersecurity / CMMC | 🔐 | Vulnerability Findings (CVE), POAM, SSP Controls, CUI Assets, Vendor Risk, Incidents, Pentest Findings, SIEM Alerts, Threat Hunting |
| Threat Intelligence | 🕵️ | IOC Hashes, IOC IPs/Domains/URLs, Threat Actors, OSINT Personas, Malware Records, C2 Infrastructure, Phishing, Dark Web |
| Cloud / Infrastructure | ☁️ | AWS CloudTrail, GuardDuty, Azure, GCP, Kubernetes, Container Logs, Exposed Secrets, IAM, Terraform |
| Corporate / Identity | 🏢 | Employee Directory, Org Records, Federal Contracts, Clearance Records, Email Headers, Active Directory, Help Desk, Change Mgmt, Asset Inventory |
Total: 88 registered generators
Each scenario generates records that share a single attacker IP, victim host, username, malware family, and chronologically advancing timestamps. Every record includes _scenario_phase and _scenario_event fields.
| Scenario | Kill Chain Phases |
|---|---|
| APT Intrusion Campaign | Recon → Initial Access → Execution → Persistence → Lateral Movement → Collection → Exfil |
| Ransomware Outbreak | Initial Access → Execution → Defense Evasion → Impact → Detection |
| Insider Threat – Data Exfiltration | Enumeration → Access → Staging → Exfil → Indicator |
| SSH Brute Force → Compromise | Scanning → Brute Force → Success → Post-Exploit → Cleanup |
| Cloud Credential Abuse | Credential Theft → Recon → Privilege Escalation → Persistence → GuardDuty Detection |
| CMMC Audit Finding Chain | Per-control findings with gap descriptions and POAM flags |
| Format | Extension | Best For |
|---|---|---|
| JSON | .json |
APIs, Python pipelines, Splunk ingestion |
| CSV | .csv |
Excel, pandas, bulk import |
| NDJSON | .ndjson |
Elasticsearch, Logstash, streaming |
| SQL INSERT | .sql |
Database seeding |
| XML | .xml |
SIEM/SOAR integrations |
| Raw Log Format | .log |
Log replay, parser testing |
| HTML Report | .html |
Briefings, demos, training handouts |
Contributions are welcome — new data types, new scenarios, bug fixes, documentation improvements.
See CONTRIBUTING.md for full instructions including how to add a generator in two steps.
Please use the GitHub issue templates to report bugs or request new data types.
See CONTRIBUTING.md for full instructions. The short version:
- Add a
@staticmethodtoSynthForgeGeneratorsinsynthforge/generators.pythat returns a plaindict - Register it in
DISPATCHinsynthforge/config.py
synthforge/
├── generators.py Word banks + all 88 generator functions
├── scenario.py 6 coherent attack chain scenarios
├── config.py Category tree, dispatch table, themes, presets
├── export.py JSON/CSV/NDJSON/SQL/XML/Raw/HTML exporters
├── enrichment.py Optional GPT-4.1-nano enrichment (openai>=1.0)
├── ui/app.py Full CustomTkinter desktop application
└── cli.py Headless CLI (argparse)
Four architecture principles:
- Zero-Custody: no data leaves your machine (unless you use GPT enrichment)
- Stdlib-Only Core: zero pip installs needed for the library
- Callables-Free Records: all generator functions return plain dicts — no lambdas or functions stored as values
- Thread-Safe Generation: all long operations run in background threads; UI never blocks
git clone https://github.com/neatlabs-ai/synthforge
cd synthforge
pip install -e ".[all]"
python -m pytest tests/ # if tests exist
python -m synthforge --cli --list-typesMIT — see LICENSE
NEATLABS™ is a platform portfolio by Security 360, LLC — a Service-Disabled Veteran-Owned Small Business (SDVOSB) with 14 years of continuous operation and 28+ years of federal cybersecurity practitioner experience.
Contact: info@neatlabs.ai | linkedin.com/in/randy-b-84aa6731 | Upper Marlboro, MD
"Others talk about it. NEATLABS™ is about it."