STSGen

STSGen, short for Security Test Scenario Generator, is a software framework designed to generate synthetic security testing scenarios and associated telemetry for evaluation, training, and research. It enables security teams, educators, and researchers to create reproducible exercises that simulate attacks, misconfigurations, and policy violations without relying on live environments.

The framework provides scenario templates, a domain-specific language for defining events, and an execution engine that can replay sequences against simulated or real targets. It supports data generation for logs, alerts, network packets, and user activity, with export options in JSON and YAML and adapters for common security tools such as SIEMs, EDRs, and incident responders. STSGen emphasizes reproducibility and controllable complexity to support iterative testing and benchmarking.

STSGen is modular, with components including a Scenario Builder, a Data Generator, a Simulator, and a Reporter. Scenarios can model a range of contexts, including network intrusions, phishing campaigns, insider threats, configuration errors, and compliance violations. The system aims to produce measurable outcomes such as detection rates, false positives, and response times, enabling objective assessments of security controls and detection rules.

Originating as an open-source project to address the need for safe, repeatable security testing, STSGen is community-maintained with contributions from researchers and practitioners across academia and industry. It is used in training labs, cyber ranges, and research studies. Limitations include the need for careful parameterization to avoid unsafe content and the requirement to validate synthetic data against real telemetry. See also cyber range, threat modeling, and security testing.