If you're a Detection Engineer, SOC Analyst, or Splunk Admin, this sounds familiar:

💔 "I spent 3 days writing a detection rule... but can't test it until someone gets attacked"
Hours of work sitting idle because you don't have realistic attack data.

😤 "My dashboard looks empty in the demo because production has no traffic logs today"
Stakeholder presentation ruined by data gaps. Embarrassing silence when panels show "No results found."

😫 "Training new analysts with 6-month-old sanitized logs that don't show modern attacks"
Your team is unprepared because training data is outdated, unrealistic, or non-existent.

💸 "The commercial log simulator costs $50k/year and still doesn't support our custom apps"
Budget blown on tools that don't even cover your specific use cases.

⏰ "I need 10,000 Palo Alto logs by tomorrow for performance testing"
Manual log creation? Impossible. Waiting for production data? Not fast enough.

Sound familiar? You're not alone.

Event-Horizon solves ALL of these problems in one tool:

💬 "I need to test ransomware detection"

🤖 Event-Horizon generates:
   ✓ Phishing email logs (cisco:esa)
   ✓ User account compromise (WinEventLog:Security)
   ✓ Malicious process execution (Sysmon)
   ✓ C2 communication (pan:threat)
   ✓ All coordinated with realistic timestamps
   
⏱️ Total time: 45 seconds

No more waiting. No more manual work. No more incomplete tests.

🎭 Template-First Design
100% format accuracy using "Golden Master" templates validated against vendor specs

🧠 AI Scenario Creation
Describe any scenario (benign traffic, system updates, or complex attacks), and AI orchestrates the logs across multiple sources

🐳 Docker Ready
Deploys in seconds with one-click Docker Compose setup

🎯 IOC Injection
Embed specific IPs, domains, or hashes for targeted testing

🕐 Timezone Support
Auto-detects browser timezone or manually set via Settings. Logs use your local time.

⚡ Lightning Fast
1000+ logs/second with templates, supports air-gapped deployments

🔒 Privacy First
100% local, no external APIs required, synthetic data only

⚙️ Unified Settings Modal
Configure Splunk HEC and Ollama AI from one centralized settings panel with connection testing

Basic (uses existing local image):

docker run -p 3000:3000 ghcr.io/prototypeprime/event-horizon:latest

Always pull latest version:

docker run --pull=always -p 3000:3000 ghcr.io/prototypeprime/event-horizon:latest

With Ollama (for AI attack scenarios):

docker run -p 3000:3000 \
  -e OLLAMA_BASE_URL=http://host.docker.internal:11434 \
  ghcr.io/prototypeprime/event-horizon:latest

Full configuration (all options):

docker run --pull=always -p 3000:3000 \
  -e OLLAMA_BASE_URL=http://192.168.1.100:11434 \
  -e TZ=America/New_York \
  ghcr.io/prototypeprime/event-horizon:latest

Open http://localhost:3000 — that's it! 🎉

# Clone the distribution repo
git clone https://github.com/PrototypePrime/Event_Horizon.git
cd Event_Horizon

# (Optional) Copy and edit config
cp .env.example .env

# Start
docker compose up -d

Open http://localhost:3000

1. Enable HEC in Splunk: Settings → Data Inputs → HTTP Event Collector
2. Create Token: Name: "Event-Horizon", Index: "main"
3. Enter in UI: Paste your HEC URL and Token in the Settings panel

Event-Horizon uses Ollama to generate realistic attack scenarios.

View Complete Reference (Verified/Beta Status) →

• Sourcetype Reference - Complete list of 75+ supported logs
• Use Cases - Real-world SOC examples
• FAQ - Common questions

All documentation is also available in the docs folder.

• v2.1 (Q1 2026): 20+ new templates, batch export
• v3.0 (Q3 2026): DeepSeek validation, real-time streaming
• v4.0 (Q1 2027): Multi-SIEM support (QRadar, Sentinel)

Full Roadmap → | Vote on Features →

We ❤️ contributions!

🐛 Report Bugs • ✨ Request Features •

Free for Personal & Educational Use.

✅ Personal projects • ✅ Learning/training • ✅ Academic research
❌ Commercial use requires permission

See LICENSE for details.