SekoiaCraft

SekoiaCraft is a multi-tenant security log generator. It simulates the realistic behaviour of fictitious users across cybersecurity technologies (CrowdStrike, Microsoft Defender, Palo Alto NGFW…) and sends the resulting logs to configurable webhooks.

The idea it is built on

A simulated user's day is described once, without naming a single technology: a workflow of abstract gestures — arriving at the office, browsing, opening a document, connecting to a server. Each gesture is then projected towards every selected technology able to describe it, with the same instant, the same entity and the same facts.

That is what makes the output worth correlating: one sign-in appears at the same second in the EDR, in the Windows log and in the identity console, and one browse names the same host in the proxy, the firewall and the DNS resolver. No noise generator gives that when each technology draws its own destination.

What works today

Thirteen screens, grouped here the way this documentation is:

Screen	What you do there
/	Health of the five backends and their dependencies, in real time
/essais	Replay an archetype's day towards real intakes — preview, then send
/journal	The record of launched trials, across bench, targeted company, archetype and simulated user
/communautes	Make a whole population live on its own, minute after minute
/pools	Give several teams exactly the same content — one community per team, each towards its own intakes
/envois	Everything posted to an intake: outcome, origin, duration and the messages themselves
/envois/file	What is waiting to be posted — unfold, replay, purge, pause
/inventaires	Every run of an asset connector, and what it built and posted — kept 24 hours
/generators	Create a source technology, its event types and their templates
/archetypes	Describe a simulated user type and the workflow of their day
/datasets	Edit reference data: sample pools and fictitious populations
/configuration	Settings that apply to the whole installation — the indicator feed key and the CVE feed
/utilisateurs	Accounts and roles, described in Security and accounts

Two of them have no page of their own yet — the dashboard and /journal. This table is, for now, all the documentation they have.

The corpus from the legacy project is imported by a script: 28 technologies, their 470 event types, their templates, 383 sample pools and six demonstration populations. Where the corpus is absent — CI, deployed environments, a workstation without Python — the database receives the same data from the SQL snapshot versioned in the repository.

A community can also carry attacker background noise: scenarios from the threat library grafted onto a few compromised hosts, which carry on with their working day while a beacon, a payload download and an exfiltration are added to it — all naming the same indicator of compromise, whichever technology observes them.

Every day, a community also sends its Sekoia workspace an inventory of OCSF assets: its workstations and servers, its users, their vulnerabilities and their software. It is the projection of the very population its logs name — an analyst going from an alert to the asset finds the same machine.

What does not exist yet

• The ambient layer and the alerts. A bench and a community play only the correlated layer — the workflow's gestures. The traffic specific to each technology, and the alerts its detection engine raises, will come with the steps that produce them; a real production's volumes would be higher.
• The alert families of the legacy project — Elevate, Sigma, POI. A threat scenario launched on demand plays attacker gestures, not those rule sets.
• SOC activity simulation — case assignment, status changes, closing comments.

Architecture

The table says what each service does today, not what it will do:

Service	Port	Role
web	3000	Dashboard, configuration editor and screens (React Router)
api-config	3001	Configuration CRUD: communities, generators, archetypes, datasets, accounts
api-activity	3002	Per-minute scheduler, trial runs, dispatch history and queue, real-time streams
api-scenario	3003	The indicator-of-compromise feed; on-demand launch of threat scenarios
api-sender	3004	Consumes the dispatch queue and posts to the intakes
docs	3005	This documentation
api-asset	3006	Daily OCSF inventory of each community, sent to Sekoia; CVE catalogue from NVD

The backends never talk to each other over HTTP: they share PostgreSQL (through packages/database) and Redis (BullMQ queues). Only web is an HTTP client — its loaders call api-config, and its live counters come from server-sent events relayed by api-activity.

Running it locally

Five commands, from a fresh clone to a running application:

pnpm install     # dependencies + Prisma client
pnpm docker:up   # PostgreSQL, Redis, pgAdmin
pnpm db:push     # the schema into the database
pnpm db:seed     # the reference data
pnpm dev         # the 7 services

Prerequisites, the .env file and what each command does are detailed in Running it locally. The configuration API exposes its Swagger UI at http://localhost:3001/api.