Event Generator
Generates synthetic events for testing pipeline functionality, transformations, and enrichments. This connector allows you to produce sample data that mimics real-world events from various security tools and platforms.
Overview
The Event Generator connector creates realistic synthetic data based on templates from over 50 different data sources including:
- AWS Security Hub Findings
- Crowdstrike security events
- Google Workspace activity logs
- Microsoft Defender alerts
- Okta system logs
- Slack user data
- Snowflake user activity
- And many more
This allows you to test your data pipelines, transformations, and detection rules without needing to connect to actual production systems.
Use Cases
- Pipeline Testing: Validate that your data pipelines are processing events correctly
- Transformation Testing: Verify that your data transformations produce the expected output
- Alert Testing: Test downstream detection rules and alerts
- Demo Environments: Create realistic data for demonstration environments
- Training: Provide sample data for training security analysts
Requirements
The Event Generator connector doesn't require any external credentials or API keys, making it a straightforward plug-and-play connector.
Configuration
The following configuration defines the input parameters for the Event Generator.
Settings
| Setting | Type | Required | Description |
|---|---|---|---|
| Record Type | string | Yes | The type of record to generate. Must be one of the available template types (see list below). |
| Rate | integer | Yes | The rate at which to generate records (between 1 and 1000 per second). |
Secrets
None required.
Available Record Types
The record_type value must be a connector type ID — the exact hyphenated identifier shown for each connector in the Monad Inputs catalog (and returned by the API's list of input types). It is not an underscore-separated name. A selection of common types:
| Record Type | Description |
|---|---|
| aws-security-hub-findings | AWS Security Hub vulnerability findings |
| box-events | Box file sharing activity events |
| box-users | Box user management events |
| cloudtrail | AWS CloudTrail audit logs |
| crowdstrike-detection-summaries | CrowdStrike Falcon detection summaries (deprecated input) |
| crowdstrike-event-stream | Crowdstrike endpoint security events |
| crowdstrike-falcon-data-replicator | Crowdstrike FDR events |
| duo-security-admin-logs | Duo Security admin activity logs |
| github-audit-logs | GitHub audit and security events |
| google-cloud-logs | Google Cloud Platform logs |
| google-workspace-admin-activity | Google Workspace admin events |
| google-workspace-login-activity | Google Workspace user login events |
| microsoft-azure-activity-logs | Microsoft Azure activity logs |
| microsoft-entra-id | Microsoft Entra ID (formerly Azure AD) events |
| microsoft-log-analytics-query | Microsoft Sentinel log analytics events |
| monad-logs | Monad organization logs |
| okta-systemlog | Okta authentication and user management events |
| okta-users | Okta user information |
| slack-users | Slack user information |
| snowflake-users | Snowflake user information |
| tenable-assets | Tenable asset discovery data |
| tenable-vulnerabilities | Tenable vulnerability scan findings |
Over 260 record types are available — one for each connector that ships a synthetic template. Use the connector's type ID exactly as it appears in the Inputs catalog. If a record_type isn't recognized, the input logs error fetching template of type: <record_type> and produces no records.
Implementation Details
The Event Generator uses pre-defined templates to create realistic synthetic data. Each template is based on the actual data structure of the corresponding service's API or logs.
The generator:
- Takes a specified record type and rate as input
- Loads the corresponding template for that record type
- Generates random but valid data following the template structure
- Emits events at the specified rate to your data pipeline
This allows for continuous generation of test data without requiring any external connections.
Example Configuration
Code
This configuration will generate 10 synthetic Okta system log events per second.
Sync frequency
By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.