Hey everyone,

Finding realistic logs for detection engineering and threat hunting practice is tough—clean logs have no attacks, and real breach dumps are messy or risky to touch.

I put together an open-source collection of 100% synthetic, SIEM-agnostic logs across 5 domains (Applications, Cloud, Email/DLP, Endpoints, and Network). Every file blends realistic background noise with hidden simulated attack vectors:

• Web/App: SQLi, XSS, directory traversal • Cloud: IAM privilege escalation, unauthorized access, audit tampering • Network: DNS tunneling, C2 beaconing, port scans, VPN anomalies • Endpoints: Windows EventID 4625 brute force, Linux privilege escalation • Email & DLP: Phishing payloads and data exfiltration

Works out of the box with Splunk, Elastic (ELK), Sentinel, Wazuh, or CLI tools (grep/awk/jq). The README includes a starter Threat Hunting Playbook with sample queries.

Totally free and MIT licensed. Hope this helps anyone building homelabs or practicing detection! Feedback and PRs are welcome.