Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake
Cisco Talos has released EvidenceForge, an open-source synthetic security log generator designed to address the limitations of existing synthetic data solutions. The tool utilizes a canonical event model, causal ordering, and realistic background noise to create correlated log datasets across multiple formats, aiming to provide more realistic training and validation data for security teams. It focuses on creating a coherent narrative from log events rather than isolated, independent events.
EvidenceForge is a new tool developed by Cisco Talos to tackle the challenge of obtaining realistic security log data for training and validation purposes. Traditional synthetic data generators often fall short by producing isolated events without establishing causal relationships or incorporating realistic background noise, leading to datasets that lack coherence and don't accurately represent real-world attack scenarios. The tool’s core innovation lies in its single canonical event model, which ensures that all log events are linked through a shared timestamp, event type, and contextual information. This approach generates correlated logs across 20+ Windows, Linux, and network monitoring formats, creating a more believable and useful dataset for security professionals. The tool also incorporates AI-assisted scenario authoring, allowing analysts to create complex attack chains and map them to the MITRE ATT&CK framework.