OCSF Simulator

A Python library and CLI that generates simulated OCSF (Open Cybersecurity Schema Framework) event streams. Useful for testing streaming pipelines, security analytics tools, SIEMs, and detection rules with realistic synthetic data.

Install

pip install .

Optional extras:

pip install ".[ocsf]"    # use the real ocsf-lib schema
pip install ".[kafka]"   # enable Kafka output
pip install ".[all]"

Use as a CLI

By default, events are written as JSON lines to stdout:

ocsf-sim --interval 1.0 --batch-size 5 --max-events 20

Send events to Kafka instead:

ocsf-sim --enable-kafka --kafka-servers localhost:9092 --kafka-topic ocsf-events

Common flags:

Run ocsf-sim --help for the full list.

Use as a library

from ocsf_simulator import JSONSchemaFaker, stream_ocsf_events

# One-shot event generation
faker = JSONSchemaFaker(ocsf_version="1.1.0")
event = faker.generate_ocsf_event(3002, profiles=["host", "security_control"])

# Streaming generator (yields events forever)
for event in stream_ocsf_events(event_classes=[3002, 4001], interval=1.0):
    print(event)

Supported event classes

The simulator can generate events for any OCSF class, with richer dedicated generators for these commonly-used ones:

License

Apache-2.0