S4 MockAPI - Security API Simulator

S4 MockAPI reproduces the shape of security-product APIs - status codes, headers, authentication flows, pagination, rate-limit and error bodies - reconstructed from public API documentation only. All data is synthetic.

• Vision One compatible profile (public API v3.0): workbench alerts with ETag/If-Match flows, endpoint inventory, endpoint-activity search, OAT detections, isolate/restore response actions with realistic task lifecycle (207 Multi-Status).
• PAN-OS compatible profile (11.x-era XML API): keygen authentication, op commands, stateful candidate-config CRUD, commit job lifecycle, async log retrieval with canonical traffic/threat/system fields.
• Microsoft Sentinel compatible profile: Azure AD OAuth2 client_credentials token, Log Analytics /v1/workspaces/{id}/query with a KQL subset (where / take / limit / project / count) over 7 seeded tables (SecurityAlert, SecurityIncident, SigninLogs, Heartbeat, AuditLogs, AzureActivity, SecurityEvent), Sentinel Incidents CRUD with ETag/If-Match and comments, entities/{id}/expand returning a 3-node graph, runPlaybook long-running-operation polling.
• CrowdStrike Falcon compatible profile: POST /oauth2/token (client_credentials, opaque bearer with expires_in) and /oauth2/revoke, Detects (queries / summaries / stateful PATCH), Devices (queries / summaries / contain-and-lift with stateful containment_status), Real Time Response session/execute/status lifecycle, Falcon Query Language subset for filter=.
• Generic OpenAPI mock: point --spec at any OpenAPI 3.x document and every documented operation is served from its examples and schemas.
• MITRE ATT&CK-shaped scenario library (10 ready-made scenarios: ransomware response T1486, credential stuffing T1110.004, lateral movement TA0008, data exfiltration TA0010, C2 detection T1071/T1573, phishing T1566, insider threat, persistence hunt, EDR mass-isolate T1490 response, Sentinel incident-triage rehearsal).
• Terraform module (s4-mockapi-aws) with IMDSv2 required, encrypted root, default 10.0.0.0/8 ingress, admin port instance-local unless opted-in; per-profile Postman collections included.
• Deterministic fault injection (TOML scenarios): nth-call 500s, probabilistic 429s with Retry-After, injected latency - test your integration's failure paths reproducibly.
• Stateful round-trips, per-credential rate limiting, TLS, admin API with health checks, Prometheus metrics, and one-call factory reset for CI.

Use it for SIEM/SOAR connector development, MSSP labs, SOC integration QA, integration test environments that spin up in seconds, partner demos, and CI pipelines. State is in-memory: restarting (or POST /reset) restores a clean dataset.

This product is an independent work built from publicly available API documentation. Trend Micro, Vision One, Palo Alto Networks, PAN-OS, Microsoft, Sentinel, CrowdStrike and Falcon are trademarks of their respective owners, used nominatively to identify compatibility targets; this product is not affiliated with or endorsed by those vendors.