S4 LogForge
Realistic SIEM test log generator
When does this pay back?
Payback depends on the cost line and replacement scope
This product's payback depends on your current AWS spend, replacement scope, and runtime environment. Use the bill calculator to identify matching cost lines and a rough savings estimate.
Estimate your savings
Enter your relevant monthly spend or usage for a rough estimate — no bill upload needed.
Generate realistic, parser-faithful security logs in 13 formats at any rate — backfill 30 days in seconds or stream in realtime. Built for SIEM PoCs, detection-rule development, dashboards, capacity sizing, and load testing. Correlated MITRE ATT&CK-tagged attack scenarios; deterministic, reproducible output.
S4 LogForge generates security logs that are field-faithful to real devices and SIEM schemas — for when you need production-like data for a SIEM project but cannot use production logs. 13 output formats are each verified end-to-end against real parsers (Elasticsearch ingest pipelines, Elastic integrations, Logstash grok / kv / xml / CEF codec): RFC 3164/5424 syslog; CEF (ArcSight-style); LEEF 2.0 (QRadar-style); PAN-OS 10.2 CSV; ECS 8.11 JSON; XDR telemetry JSON; Windows Event/Winlogbeat; CloudTrail; VPC Flow; Zeek; Suricata.
The problem
Building or validating a SIEM requires realistic security logs, yet production logs are sensitive and unavailable, and hand-faked logs neither survive real parsers nor carry known ground truth. S4 LogForge generates field-faithful, parser-verified test logs with built-in ground truth, so you can move a SIEM project forward without touching production data.
How it works
- 1
Choose formats and scenarios
Select from 13 output formats and MITRE ATT&CK-tagged attack scenarios, and author your own with the TOML DSL when needed.
- 2
Generate backfill or realtime
Backfill 30 days in minutes, or stream a realtime diurnal curve to file, syslog, Elasticsearch, or Splunk HEC.
- 3
Measure detections vs ground truth
Because injected scenarios are known ground truth, you can score detection and false-positive rates against it.
Highlights
13 parser-faithful formats — syslog 3164/5424, CEF, LEEF, PAN-OS CSV, ECS JSON, Windows Event/Winlogbeat, CloudTrail, VPC Flow, Zeek, Suricata, XDR telemetry — each verified against real parsers, not just 'looks like a log'.
Correlated, MITRE ATT&CK-tagged attack scenarios injected into realistic baseline noise, plus a TOML DSL to author your own — measure detection and false-positive rates against known ground truth.
Deterministic and rate-controlled: same seed reproduces byte-identical data; sustain 188k–1.6M events/sec, backfill 30 days in minutes, or stream a realtime diurnal curve to file, syslog, Elasticsearch or Splunk HEC.
What's included
- 13 parser-verified output formats (RFC 3164/5424 syslog, CEF, LEEF 2.0, PAN-OS 10.2 CSV, ECS 8.11 JSON, XDR telemetry JSON, Windows Event Log XML / Winlogbeat, CloudTrail, VPC Flow, Zeek, Suricata)
- End-to-end verification against real parsers including Elasticsearch ingest, Elastic integration pipelines, and Logstash grok/kv/xml/CEF codecs
- Correlated, MITRE ATT&CK-tagged attack scenarios injected into realistic baseline noise, with a TOML DSL to author your own
- Deterministic seeded reproducibility: the same seed reproduces byte-identical data
- Throughput of 188k–1.6M events/sec, with 30-day backfill generated in minutes
- Output sinks: file, syslog, Elasticsearch, and Splunk HEC
Use cases
Run SIEM PoCs and evaluations without production logs
Develop and tune detection rules against known ground truth
Build and validate dashboards on representative data
Perform capacity sizing and load testing
FAQ
Are the logs realistic enough?
All 13 formats are verified end-to-end against real parsers such as Elasticsearch ingest, Elastic integration pipelines, and Logstash grok/kv/xml/CEF codecs. They are field-faithful to real devices and SIEM schemas, not merely something that looks like a log.
Can I reproduce runs?
Yes. Generation is deterministic: the same seed reproduces byte-identical data.
How do I measure detection quality?
Correlated, MITRE ATT&CK-tagged scenarios serve as known ground truth, so you can measure detection and false-positive rates against it.
What can it feed?
It can output to file, syslog, Elasticsearch, and Splunk HEC, for both backfill and realtime streaming.
How fast, and how much data?
It sustains 188k–1.6M events/sec and backfills 30 days of data in minutes.
Why it's cheaper
Assumes ongoing generation of 13 security-log formats with monthly SIEM/SOC detection-rule regression tests.
- BAS / commercial tool licenses
- $3,500 / mo
- Engineer time (0.2 FTE)
- $3,300 / mo
- Monthly total
- $6,800 / mo
- S4 LogForge instance (t3.medium + software fee)
- $80 / mo
- Engineer time (0.02 FTE)
- $330 / mo
- Monthly total
- $410 / mo
Sizing the S4 LogForge instance by format coverage
| Formats in scope | Recommended instance | S4 LogForge instance cost | Total vs. in-house ops |
|---|---|---|---|
| 1–3 formats | t3.small | $40 / mo | $40 / mo (in-house $2,500, −98%) |
| 4–8 formats | t3.medium | $80 / mo | $80 / mo (in-house $4,200, −98%) |
| All 13 formats | m5.large | $120 / mo | $120 / mo (in-house $6,800, −98%) |
Illustrative example. SecOps engineer cost assumes a $200k/yr salary (~$16,600/mo), with 0.2 FTE / 0.02 FTE allocations. Commercial BAS (Breach and Attack Simulation) tools range $40k–$200k/yr; we use the middle of the range (~$3,500/mo). S4 LogForge is sized to replace both the in-house script upkeep and the BAS license; the residual engineer time covers new scenario authoring only.
Pricing model
Hourly software fee + EC2 (t3 class and up). Metered per instance type, no license keys.
Other S4 products
S4 — Squished S3
Transparent GPU S3-compression gateway
S4 Logs
Archive CloudWatch Logs to zstd S3
S4 Metrics
Govern CloudWatch metric cardinality