# Test Event Scripts

## Send Wazuh test events

Use this to inject synthetic SOC events via syslog UDP into Wazuh manager.

```bash
scripts/send-wazuh-test-events.sh [scenario] [count] [delay_seconds]
```

Scenarios:
- `ioc_dns`
- `ioc_ips`
- `vpn_outside_th`
- `windows_auth_fail`
- `all`

Examples:

```bash
scripts/send-wazuh-test-events.sh all
scripts/send-wazuh-test-events.sh vpn_outside_th 5 0.2
WAZUH_SYSLOG_HOST=127.0.0.1 WAZUH_SYSLOG_PORT=514 scripts/send-wazuh-test-events.sh ioc_ips
```

Environment overrides:
- `WAZUH_SYSLOG_HOST` (default `127.0.0.1`)
- `WAZUH_SYSLOG_PORT` (default `514`)
- `WAZUH_TEST_SRC_IP`
- `WAZUH_TEST_DOMAIN`
- `WAZUH_TEST_USER`