https://github.com/splunk/salo
Synthetic Adversarial Log Objects: A Framework for synthentic log generation
https://github.com/splunk/salo
Last synced: about 2 months ago
JSON representation
Synthetic Adversarial Log Objects: A Framework for synthentic log generation
- Host: GitHub
- URL: https://github.com/splunk/salo
- Owner: splunk
- License: apache-2.0
- Created: 2021-10-26T14:10:52.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2024-01-11T18:45:51.000Z (over 1 year ago)
- Last Synced: 2024-11-02T04:33:04.473Z (7 months ago)
- Language: Python
- Size: 3.9 MB
- Stars: 77
- Watchers: 8
- Forks: 8
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project
- awesome-detection-engineering - Synthetic Adversarial Log Objects (SALO) | Splunk - Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event. (Concepts & Frameworks)
README
[](https://splunk.github.io/salo)
[](https://github.com/splunk/salo/blob/main/LICENSE)
[](https://www.python.org)
[](#)
## Synthetic Adversarial Log Objects (SALO)
Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need
for infrastructure or actions to initiate the event that causes a log event. The purpose of this
framework is to allow security practitioners, data scientists, and researchers the ability to create log
events in a simple, repeatable, and randomized way without the overhead of traditional required resources.
Want to learn more? Take a look at the [documentation](https://splunk.github.io/salo).
## Why SALO?
In the past, in order to generate simple network security logs, such as DNS queries for a malicious domain,
it would be required to build one or more servers, as well as a network monitoring solution to capture
events. Additionally, the DNS queries would have to be sent to a resolver with no simple way to construct
custom requests or responses. This process can be time consuming, present technical and financial hurdles,
and be extremely cumbersome or difficult to accomplish. This is especially so for more complex scenarios
that may require highly technical deployments of software, services, and/or cloud native technology.
SALO seeks to simplify the task of creating and collecting log events from any source that generates
them by constructing models for such events and a simple method for defining attributes and their values.
## Demo
[](#)
## Quick Start
Create a new [venv](https://docs.python.org/3/library/venv.html) for SALO:
```bash
$ python3 -m venv ~/.venv/salo
```
Activate the new ``venv`` environment:
```bash
$ source ~/.venv/salo/bin/activate
```
Clone the respository:
```bash
$ git clone https://github.com/splunk/salo
```
Change directories to the newly cloned one:
```bash
$ cd salo
```
Then, install SALO and neccessary requirements:
```bash
$ pip3 install -e .
```
Once installed, you can simply run ``salo``. Multiple example `recipes` can be found in the [examples/recipes/ folder](examples/recipes/):
```bash
$ salo recipe examples/recipes/beacon.yaml
```
For more advanced use cases of SALO, take a look at some [example recipes](examples/recipes/) as well as the [project documentation](https://splunk.github.io/salo).
## Support
This software is released as-is. Splunk provides no warranty and no support on this software.
## License
Copyright 2021 Splunk Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.