Forest Global Training Partners

Cyber Risks · Cisco Talos

Introducing Evidence Forge: Synthetic security logs that don’t look (as) fake

Summary: Cisco Talos released EvidenceForge, an open-source project that generates correlated synthetic security logs across 20+ formats (Windows, Linux, network, and EDR telemetry) from a single canonical SecurityEvent object, so emitters share one PID, LogonID, timestamp, and Zeek UID. Scenarios are authored as YAML files with optional AI assistance from Claude/Codex skills, then generated deterministically by a Python script that also models sensor placement and background noise.

What's compelling: Talos states plainly that no purely synthetic dataset will fool a seasoned analyst in every case, so the value sits in labeled ground truth and reproducible output for training hunters and tuning detections - not in substituting for production telemetry.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026