S4 MockAPI
Security API simulator
When does this pay back?
Payback depends on the cost line and replacement scope
This product's payback depends on your current AWS spend, replacement scope, and runtime environment. Use the bill calculator to identify matching cost lines and a rough savings estimate.
Estimate your savings
Enter your relevant monthly spend or usage for a rough estimate — no bill upload needed.
Mock server that answers like real security products' APIs. Build and test SIEM/SOAR integrations without product licenses: Trend Micro Vision One, Palo Alto Networks PAN-OS, Microsoft Sentinel, and CrowdStrike Falcon compatible profiles, plus a generic mock for any OpenAPI 3.x document. Ships with an ATT&CK-shaped scenario library and a Terraform module.
S4 MockAPI reproduces the shape of security-product APIs — status codes, headers, authentication flows, pagination, rate-limit and error bodies — reconstructed from public API documentation only. All data is synthetic. Vision One compatible (public API v3.0): workbench alerts with ETag/If-Match flows, endpoint inventory, endpoint-activity search, OAT detections, isolate/restore response actions (207 Multi-Status). PAN-OS compatible (11.x-era XML API): keygen authentication, op commands, stateful candidate-config CRUD, commit job lifecycle. Microsoft Sentinel compatible: Azure AD OAuth2 client_credentials token, Log Analytics `/v1/workspaces/{id}/query` with a KQL subset (where / take / limit / project / count) over 7 seeded tables, Sentinel Incidents CRUD with ETag/If-Match, `entities/{id}/expand` returning a 3-node graph, `runPlaybook` long-running-operation polling. CrowdStrike Falcon compatible: `POST /oauth2/token` (client_credentials → opaque bearer), Detects / Devices / Real Time Response endpoints, stateful `contain / lift_containment`, Falcon Query Language filter subset. Ships with an ATT&CK-shaped scenario library (10 scenarios), a Terraform module, and per-profile Postman collections.
The problem
Building and testing SIEM/SOAR integrations means hitting real security-product APIs like Trend Micro Vision One, Palo Alto PAN-OS, Microsoft Sentinel, and CrowdStrike Falcon, but licenses are expensive and limited, and there is rarely a spare sandbox to develop against. You cannot point CI at production security tooling, and failure paths like errors and throttling are hard to reproduce on demand. So integration code goes under-tested and breaks for the first time in production.
How it works
- 1
Launch the AMI, pick a profile
Boot the AMI and the Vision One compatible profile starts on :8080 by default, switchable to the PAN-OS, Microsoft Sentinel, CrowdStrike Falcon, or generic OpenAPI profile via one env file. Provision with the bundled Terraform module (`s4-mockapi-aws`) for IMDSv2-required, encrypted-root, admin-port-instance-local defaults.
- 2
Point your integration at the mock
Repoint your connector or pipeline from the real API to the mock's endpoint and get faithful status codes, headers, auth flows and pagination without a product license.
- 3
Inject faults, then reset
Inject failures like a 500 on the nth call, throttling with Retry-After, or latency deterministically via TOML scenarios, then factory-reset in one API call to rerun from a clean state.
Highlights
Four vendor-faithful profiles (Vision One / PAN-OS / Sentinel / CrowdStrike) plus a generic OpenAPI 3.x mock — one AMI covers your integration-test surface.
ATT&CK-shaped scenario library (10 ready-made scenarios: ransomware T1486, credential stuffing, lateral movement, C2, data exfiltration and more) plus deterministic fault injection — reproduce IR-grade API load and failure paths in CI.
Terraform module (`s4-mockapi-aws`) and per-profile Postman collections included; boots to a working mock in under a minute, factory-resets in one API call, nothing leaves the instance.
What's included
- Trend Micro Vision One compatible REST profile (public API v3.0): workbench alerts with ETag/If-Match flows, endpoint inventory, endpoint-activity search, OAT detections, and isolate/restore response actions with a realistic task lifecycle (incl. 207 Multi-Status).
- Palo Alto Networks PAN-OS compatible XML API profile (11.x era): keygen authentication, op commands, stateful candidate-config CRUD, commit job lifecycle, and asynchronous log retrieval.
- Microsoft Sentinel compatible profile: Azure AD OAuth2 client_credentials token, Log Analytics `/v1/workspaces/{id}/query` with a KQL subset (where / take / limit / project / count) over 7 seeded tables (SecurityAlert, SecurityIncident, SigninLogs, Heartbeat, AuditLogs, AzureActivity, SecurityEvent), Sentinel Incidents CRUD with ETag/If-Match and comments, `entities/{id}/expand` returning a 3-node graph, and `runPlaybook` long-running-operation polling.
- CrowdStrike Falcon compatible profile: `POST /oauth2/token` (client_credentials → opaque bearer with `expires_in`) and `POST /oauth2/revoke`; Detects `GET /queries/detects/v1` + `POST /entities/summaries/GET/v1` + stateful `PATCH /entities/detects/v2`; Devices queries + summaries + stateful `contain / lift_containment` reflected in `containment_status`; Real Time Response session / execute / status lifecycle (queued → executing → completed); Falcon Query Language subset for `filter=`.
- Generic OpenAPI 3.x mock: feed any OpenAPI document and every documented operation is served from its examples and schemas.
- Faithful reproduction of status codes, headers, auth flows, pagination, rate-limiting and error bodies as documented, with schema conformance enforced in CI.
- Deterministic fault injection: nth-call 500s, probabilistic 429s with Retry-After, and injected latency to make failure-path tests reproducible.
- One-call factory reset (POST /reset) and seed-file overrides so your own demo data becomes the factory state.
- MITRE ATT&CK-shaped scenario library (10 scenarios), Terraform module (`s4-mockapi-aws`), and per-profile Postman collections: ransomware response (T1486), credential stuffing (T1110.004), lateral movement (TA0008), data exfiltration (TA0010), C2 detection (T1071 / T1573), phishing (T1566), insider threat, persistence hunt, EDR mass-isolate, and Sentinel incident-triage rehearsal.
- Fully offline operation: state is in-memory only, the instance makes no outbound calls, and nothing leaves the instance.
Use cases
Develop SIEM/SOAR connectors and pipelines against Vision One, PAN-OS, Microsoft Sentinel, CrowdStrike Falcon, or any OpenAPI API without a live appliance.
Test failure paths like 500s, throttling and latency reproducibly in CI using deterministic fault injection and reset.
Run partner demos and internal training safely, without touching production security products.
Use it as an onboarding environment for engineers learning the API integration before product licenses are assigned.
Use it as an MSSP lab or SOC integration-QA harness — replay MITRE ATT&CK-shaped scenarios (ransomware / lateral movement / C2 / data exfiltration and more) to rehearse the API load and failure patterns of real IR work and Sentinel incident triage.
FAQ
Is this real vendor data?
No. All returned data is synthetic, reproducing only the shape of the APIs reconstructed from public documentation. Trend Micro, Vision One, Palo Alto Networks, PAN-OS, Microsoft, Sentinel, CrowdStrike and Falcon are trademarks used nominatively to identify compatibility targets; this product is not affiliated with or endorsed by those vendors.
Can I use it in CI?
Yes, it is designed for CI. Deterministic fault injection via TOML scenarios (nth-call 500s, 429s with Retry-After, latency) reproduces failure paths, and POST /reset returns it to factory state between runs so every test starts from the same baseline.
Does anything leave the instance?
No. It runs fully offline inside your own VPC. State is held in-memory only, the instance makes no outbound calls, and the synthetic data never leaves the instance.
Which APIs are covered?
Five: Trend Micro Vision One compatible REST shapes (public API v3.0), Palo Alto Networks PAN-OS compatible XML API shapes (11.x era), Microsoft Sentinel compatible (Azure AD OAuth2, a KQL subset over Log Analytics, Sentinel Incidents, `runPlaybook` LRO), CrowdStrike Falcon compatible (OAuth2 client_credentials, Detects / Devices / Real Time Response, an FQL subset for `filter=`), and a generic mock that reproduces any REST API from an OpenAPI 3.x document.
How fast can I stand it up?
It boots to a working mock in under a minute. The AMI auto-starts the Vision One compatible profile on :8080, and a small instance such as t3.micro is enough to run it.
Why it's cheaper
Assumes a dev team running SIEM/SOAR integration tests and CI that need 3 vendor security APIs (Vision One, PAN-OS, CrowdStrike Falcon).
- Vision One sandbox license
- $1,200 / mo
- PAN-OS dev license
- $1,500 / mo
- CrowdStrike Falcon dev license
- $800 / mo
- Monthly total
- $3,500 / mo
- S4 MockAPI instance (t3.medium + software fee)
- $80 / mo
- Monthly total
- $80 / mo
Sizing the S4 MockAPI instance by API surface
| APIs mocked | Recommended instance | S4 MockAPI instance cost | Total vs. real licenses |
|---|---|---|---|
| 1 product | t3.small | $40 / mo | $40 / mo (License $1,200, −97%) |
| 3 products | t3.medium | $80 / mo | $80 / mo (License $3,500, −98%) |
| 10+ products | m5.large | $120 / mo | $120 / mo (License $12,000, −99%) |
Illustrative example. Real-license costs estimate vendor dev / sandbox pricing at $800–$1,500/mo each, using the middle of the range (actual prices vary by contract and seat count). S4 MockAPI is intended for dev / CI environments; staging and prod should still use the real APIs. This product is not a production replacement.
Pricing model
Hourly software fee + EC2 (broad instance-type coverage). Metered per instance type, no license keys.
Other S4 products
S4 — Squished S3
Transparent GPU S3-compression gateway
S4 Logs
Archive CloudWatch Logs to zstd S3
S4 Metrics
Govern CloudWatch metric cardinality