|
| 1 | +This script makes it easy to create the endpoint metadata, alert, and event documents needed to test Resolver in Kibana. |
| 2 | +The default behavior is to create 1 endpoint with 1 alert and a moderate number of events (random, typically on the order of 20). |
| 3 | +A seed value can be provided as a string for the random number generator for repeatable behavior, useful for demos etc. |
| 4 | +Use the `-d` option if you want to delete and remake the indices, otherwise it will add documents to existing indices. |
| 5 | + |
| 6 | +The sample data generator script depends on ts-node, install with npm: |
| 7 | + |
| 8 | +```npm install -g ts-node``` |
| 9 | + |
| 10 | +Example command sequence to get ES and kibana running with sample data after installing ts-node: |
| 11 | + |
| 12 | +```yarn es snapshot``` -> starts ES |
| 13 | + |
| 14 | +```npx yarn start --xpack.endpoint.enabled=true --no-base-path``` -> starts kibana |
| 15 | + |
| 16 | +```cd ~/path/to/kibana/x-pack/plugins/endpoint``` |
| 17 | + |
| 18 | +```yarn test:generate --auth elastic:changeme``` -> run the resolver_generator.ts script |
| 19 | + |
| 20 | +Resolver generator CLI options: |
| 21 | +```--help Show help [boolean] |
| 22 | + --seed, -s random seed to use for document generator [string] |
| 23 | + --node, -n elasticsearch node url |
| 24 | + [string] [default: "http://localhost:9200"] |
| 25 | + --eventIndex, --ei index to store events in |
| 26 | + [string] [default: "events-endpoint-1"] |
| 27 | + --metadataIndex, --mi index to store endpoint metadata in |
| 28 | + [string] [default: "endpoint-agent-1"] |
| 29 | + --auth elasticsearch username and password, separated by |
| 30 | + a colon [string] |
| 31 | + --ancestors, --anc number of ancestors of origin to create |
| 32 | + [number] [default: 3] |
| 33 | + --generations, --gen number of child generations to create |
| 34 | + [number] [default: 3] |
| 35 | + --children, --ch maximum number of children per node |
| 36 | + [number] [default: 3] |
| 37 | + --relatedEvents, --related number of related events to create for each |
| 38 | + process event [number] [default: 5] |
| 39 | + --percentWithRelated, --pr percent of process events to add related events to |
| 40 | + [number] [default: 30] |
| 41 | + --percentTerminated, --pt percent of process events to add termination event |
| 42 | + for [number] [default: 30] |
| 43 | + --numEndpoints, --ne number of different endpoints to generate alerts |
| 44 | + for [number] [default: 1] |
| 45 | + --alertsPerEndpoint, --ape number of resolver trees to make for each endpoint |
| 46 | + [number] [default: 1]``` |
0 commit comments