SIEM Search, filter, event drilldown, correlation inspection, and alert inspection for Northwind Field Office (synthetic). This public simulation does not run investigations, connector ingest, or a query workbench, and it does not contact a monitoring service.
Interactive simulation Request a full evaluation Synthetic fixture pub-siem-synth-v1. Not customer data. Not a live ingest. Surface: header.
Events Alerts Correlation
Synthetic fixture pub-siem-synth-v1. Not customer data. Not a live ingest. Surface: events.
Severity All severities critical high medium low
Category All categories authentication process network identity
Showing 10 of 10 synthetic events
Impossible travel: synthetic user riley.chen signed in from 192.0.2.14 and 198.51.100.22 within four minutes. evt-1001 · 2026-04-02T13:58:11Z · riley.chen · 198.51.100.22 high Sign-in success for synthetic user riley.chen from 198.51.100.22 (fixture site Bravo). evt-1003 · 2026-04-02T13:58:02Z · riley.chen · 198.51.100.22 medium Sign-in success for synthetic user riley.chen from 192.0.2.14 (fixture site Alpha). evt-1002 · 2026-04-02T13:54:02Z · riley.chen · 192.0.2.14 medium Local administrators group gained synthetic account svc-backup-demo on nwo-win-04.demo.invalid. evt-1004 · 2026-04-02T11:16:40Z · svc-backup-demo · 192.0.2.44 high Process creation on nwo-win-04.demo.invalid recorded a local administrators membership change for svc-backup-demo. evt-1005 · 2026-04-02T11:15:10Z · fixture-admin · 192.0.2.44 medium Outbound connection from nwo-lnx-edge.demo.invalid to 203.0.113.50 port 443 by rare process demo-beacon. evt-1006 · 2026-04-02T09:40:18Z · svc-edge · 203.0.113.10 critical Rare process demo-beacon started by synthetic user svc-edge on nwo-lnx-edge.demo.invalid. evt-1007 · 2026-04-02T09:39:02Z · svc-edge · 203.0.113.10 high Sign-in success for synthetic user jordan.hale from 192.0.2.40. evt-1008 · 2026-04-02T08:05:00Z · jordan.hale · 192.0.2.40 low DNS query for updates.example.invalid from nwo-win-02.demo.invalid. evt-1009 · 2026-04-02T07:12:33Z · jordan.hale · 192.0.2.18 low Password reset completed for synthetic user avery.nguyen by the fixture helpdesk. evt-1010 · 2026-04-01T22:18:44Z · avery.nguyen · 198.51.100.8 medium