Synthetic event

A synthetic event is a log record generated to look like the result of a specific attack behaviour, used to test whether a detection fires. It avoids waiting for a real incident and avoids running attacks in production. Generators range from simple test events to attack simulation tools.

What Synthetic event means here

Synthetic events test the path from log to alert. They show whether the parser, the field mapping and the rule all work together for a technique.

They are only as good as their fidelity. An event that omits a field the real log carries can pass a test that production would fail.

Example of Synthetic event in Splunk Enterprise Security documentation

Splunk's contentctl README lists Attack Range, Attack Data and Atomic Red Team in its ecosystem table as the tools that generate and replay attack events for testing content. raw.githubusercontent.com read 2026-11-03

Terms related to Synthetic event

• Rule unit test: A rule unit test runs a detection against a small set of sample events and checks whether it alerts on the ones it should and stays quiet on the others.
• Replay: Replay runs a rule over historical data to see what it would have alerted on.
• ATT&CK coverage: ATT&CK coverage is the share of MITRE ATT&CK techniques a set of detections maps to.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.