Stream into your tools
Built-in targets for Kafka, Splunk HEC, Microsoft Sentinel, Datadog, Sumo Logic and OpenSearch, alongside socket and WebSocket delivery.
AI-assisted synthetic telemetry
Your scenario. A living stream.
Create realistic telemetry with AI. Keep it flowing. Measure how your tools respond.
Model IT, industrial, cloud and AI environments. Generate normal activity and known threats, deliver the logs into your pipeline, and compare detections with ground truth.
AI-assisted authoring Fresh continuous emission Detection validation
From your idea to an inspectable scenarioReal product view
For detection engineers, test teams and product builders.Private preview
See the workflow
See DataCannon in action.
Follow a fictional water-treatment test from a reusable equipment pattern to an AI-assisted scenario, repeatable samples and continuous JSON logs. Inspect the planned event, then stop and download the output.
Watch on YouTubeYouTube loads when you press play. Video privacy
The workflow
From an idea to a test you can repeat.
Use a fictional water-treatment plant as an example: generate normal controller activity, introduce a logic change, and see whether your tools notice.
Describe the test
Start with a description, an existing example or uploaded logs. AI helps turn the idea into editable configuration.
Connect the ingredients
Bring equipment, relationships, normal activity and anomalies together in one scenario.
Keep events flowing
Generate fresh telemetry continuously or produce a finite dataset. Choose the rate and destination.
Measure the response
Compare known injected activity with detection results. Find missed techniques and regressions.
01 / Describe the environment
Start with what you want to test.
Describe the equipment and activity in plain language. AI helps assemble the configuration, and you decide what to keep.
- Author and refine. Create scenarios and library elements, ask questions, and review proposed edits.
- Start from real examples. Upload logs or packet captures to propose a scenario resembling your environment.
- Keep control of the result. Inspect configuration, get explanations for errors and draft detection rules.
02 / Build a connected scenario
Equipment, relationships and activity.
A pattern defines the environment. A scenario adds timing, behaviours, anomalies and outputs. Reuse these ingredients across tests.
Illustrative topologyWater-treatment plant
Control network
Field sensor
sensorPLC controller
plcOperator HMI
hmiHistorian
historianModbus TCP · OPC UA · DNP3
Model normal polling, then introduce a controller logic change.
- 383
- Asset types in the model
- 112
- Protocol identifiers
- 41
- Anomaly handlers
- 8
- Signal shapes
Asset and protocol counts describe the modelling vocabulary. Vendor-specific log formats and output connectors are configured separately.
03 / Keep telemetry flowing
Fresh events, until you say stop.
Keep a test environment active with continuous generation. Control the event rate, watch delivery progress, and stop generation while pending delivery finishes.
- Continuous generation
- Fresh events, saved checkpoints and restart recovery. Stop manually or set a limit.
- Finite runs & replay
- Generate a bounded dataset, reuse a seed, or replay generated events with playback controls.
Shape the activity over time
- Continuous
- Spike
- One-time
- Stepped
- Sawtooth
- Pulse
- Degrading
- Silent
Add background noise, working-hour patterns, jitter and enrichment such as DNS, authentication and asset inventory.
TimeAssetEvent
PLC-01INFONormal controller activityHMI-01INFOOperator session establishedSENSOR-01INFOSensor observation received3 / 6 example recordsSample paused
Browser illustration with six fictional records, not a live product run. The application generates fresh events until Stop or a configured limit.
04 / Test the difficult conditions
Make the test harder. Keep the reference clean.
Combine attack sequences with imperfect delivery. Check what happens when records arrive twice, late, damaged, with clock drift—or not at all.
Clean reference
- Event 001
- Event 002
- Event 003
Ground truth stays intact.
Delivered stream
- Event 001
- Event 002
- Event 003
All three records arrive once and in order.
Interactive illustration. Defect probabilities and timing are configurable in DataCannon.
Threat scenarios across IT, OT, cloud, identity and AI.
Model ransomware, credential abuse, exfiltration and PLC changes. Eight AI-specific handlers cover prompt injection, RAG poisoning, agent tool abuse, token theft and MCP-related threats.
05 / Connect your pipeline
Send the data where you need it.
Choose the format and destination for each stream. For finite runs, export datasets or write typed records to a configured database.
Your scenarioNormal activity + known threats
Your formatJSON · Syslog · CEF · LEEF
Your destinationKafka · SIEM · file · socket
Export the dataset
JSON, NDJSON, CSV, Excel, Parquet, OCSF and UDM. Database outputs include PostgreSQL, MySQL, MongoDB and SQLite files.
Adapt the representation
Use custom templates and vendor-oriented formats to test your parser and field mappings. Keep ground truth alongside the telemetry.
Batch datasets, database exports and ML training files currently require a finite run. Continuous generation uses log streams.
06 / Measure the response
Know what happened. Check what was detected.
Ground truth is the answer key: which activity DataCannon injected, on which assets, and when. Compare it with what your detection tools reported.
Evaluate rule logic
Run the supported Sigma rule subset against generated events. Inspect matches, misses, precision, recall and false positives.
Check the SIEM round trip
Send events through your ingestion path, upload the resulting alerts, and compare them with ground truth. Compare validations to find regressions.
Known injected activityReturned alert
Controller logic modification Matched
Credential abuseMissing
A missing alert becomes a specific gap to investigate. Change the rule or pipeline, rerun the scenario, and compare the results.
Example outcomes, not a connected SIEM result or a production effectiveness claim.
Generated with DataCannon · fictional data
Download sample + ground truth A real sample from the water-treatment test.
Four assets, a five-minute scenario and one PLC logic-modification sequence. The finite local run produced 912 events, including eight anomaly events. Inspect an excerpt and its ground-truth record.
This demonstrates generated data, not a throughput benchmark or an external SIEM result.
Inside the application
See the workspace behind the workflow.
Real product captures. Open a view to inspect it at full size.
Describe the test. Inspect the proposal.
Create patterns, scenarios, anomalies, behaviours and noise profiles with AI. Ask questions, review proposed changes and keep the configuration editable.
Take the same scenario further
From a first test to a repeatable practice.
Automate regression checks
Schedule runs or use the API and CLI. Gate CI with detection and noise thresholds, and export JUnit, SARIF or GitHub Check reports.
Build ML training data
Export labelled normal and anomalous events with extracted features, class balancing and reproducible train, validation and test splits.
Share reusable tests
Fork library elements and keep scenario versions. Import, export and share scenarios and their supporting ingredients with other teams.
Bring a demo to life
Give a product or training environment representative activity, known incidents and inspectable evidence without using customer records.
A few useful distinctions
Before you start.
What does AI do in DataCannon?
AI helps author and refine scenarios and library elements, propose a scenario from uploaded logs or packet captures, explain configuration problems, generate payload text and draft Sigma rules. Review generated proposals before using them. Saved scenarios run through the generator; each emitted log does not require a new AI request.
What is a scenario?
A scenario is the recipe for a test: equipment and connections from a topology pattern, scale, timing, activity, anomalies, noise and outputs. The library holds reusable ingredients. A run generates telemetry from that recipe.
Can it keep emitting fresh logs?
Yes. Continuous generation produces fresh events from Start until Stop or an optional configured limit, with checkpoints and delivery progress. Replay is a separate option for playing a generated dataset with playback controls. Downloadable batch datasets, database exports and ML training files currently require Run once.
Do 383 asset types mean 383 vendor log formats?
No. The asset catalog defines 383 modelled equipment, service and platform types. The schema also accepts 112 protocol identifiers. These counts describe the modelling vocabulary, not 383 vendor-certified formats or 112 implemented network protocol stacks. Output formats and connectors are configured separately.
Does DataCannon launch real attacks?
DataCannon generates synthetic telemetry describing activity. Attack scenarios produce events for your test tools to analyse; they do not exploit real equipment.
What does detection validation tell me?
Built-in evaluation checks the supported Sigma rule subset against generated events. A round-trip test compares alerts from your actual SIEM with the known injected activity. Results describe the tested scenario and configuration; they do not certify production security.
Make the test concrete
Bring a scenario.
We’ll show you the workflow.
Tell us what you’re testing, where the events need to go, and how you want to measure the result.