Patent ID: 11928605
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 19:
20. A computer program product for generating an attack event log comprising a computer readable storage medium having program instructions embodied therewith, and wherein the program instructions are executable by a processor to cause the processor to:
receive a selection of event log templates representing different log sources and entry types, wherein log entries in the event log templates do not represent a consistent attack scenario;
receive an attack description comprising user instructions to fabricate synthetic log entries according to a format defined in the event log template, the attack description comprising variables and rules for determining values for the variables;
automatically generate the attack event log representing an attack scenario and comprising a synthetic log entry that is fabricated by determining values that satisfy the rules and writing the values into the selected fields of the event log templates and combining the resulting log entries representing a plurality of different types of sub attacks using a temporal ordering of events in a manner that is consistent across the attack scenario;
generate a stream of events that is consistent based the automatically generated attack event log by integrating a benign event log file that excludes attacks with the automatically generated attack event log; and
send the generated stream of events to a Security Information and Event Management (SIEM) system, wherein the generated stream of events is used to test the SIEM.