Introduction
What Tracemill is and why it exists.
Tracemill validates SIEM detections. It injects high-fidelity synthetic telemetry at your pipeline's entry point — no agents, no real attacks — and verifies that the expected alerts fire.
Why Tracemill?
Detections break silently. A field gets renamed, a pipeline change drops events, a parser update rewrites a value, and a detection that worked when it was written stops firing without any error. Testing it once tells you it worked then, not that it works now.
Tracemill generates events that mirror real attack telemetry — stateful sequences, correlated identifiers, realistic field values — from declarative YAML scenarios. It sends them through the same path as your production data and checks that each detection still fires.
Two ways to run it
- CLI — generate and deliver events yourself, locally or in CI.
- Cloud — Tracemill Cloud, the managed service that verifies the alerts fired, with targets, pipelines, and run history.
Both share the same engine model.
Start here
- How it works — the Pool → Scenario → Runner → Sink model
- Scenarios — the core building block
- Install the CLI — generate your first events