NOTICE

Replicant
Copyright 2026 Imran Hafeez (RZA)

This product is licensed under the Apache License, Version 2.0.
See the LICENSE file for the full terms.

-------------------------------------------------------------------------------
MITRE ATT&CK
-------------------------------------------------------------------------------
This project uses MITRE ATT&CK.
(c) 2026 The MITRE Corporation. This work is reproduced and distributed with
the permission of The MITRE Corporation. ATT&CK is a registered trademark of
The MITRE Corporation. Use of ATT&CK does not imply endorsement by
The MITRE Corporation.
https://attack.mitre.org/

-------------------------------------------------------------------------------
Third-party trademarks, and the absence of any vendor affiliation
-------------------------------------------------------------------------------
Replicant is an independent project. It is not affiliated with, sponsored by,
endorsed by, or in any way officially connected to Fortinet, Inc., Palo Alto
Networks, Inc., Check Point Software Technologies Ltd., Open Text Corporation,
Exabeam (LogRhythm), or any other vendor whose products or log formats it
emulates.

Fortinet, FortiGate and FortiOS are trademarks of Fortinet, Inc. Palo Alto
Networks and PAN-OS are trademarks of Palo Alto Networks, Inc. Check Point is a
trademark of Check Point Software Technologies Ltd. ArcSight and the Common
Event Format (CEF) originate with ArcSight, now part of Open Text Corporation.
OpenText documents CEF as an open log management standard that third parties may
implement; Replicant emits CEF on that basis. Replicant has NOT been through the
OpenText Technology Alliance certification program and makes no claim of CEF
certification, CEF compliance, or ArcSight validation.
LogRhythm is a trademark of Exabeam, Inc. All other trademarks are the property
of their respective owners.

These names are used solely to identify the products whose log formats Replicant
reproduces, which is information a detection engineer needs in order to know what
the output is meant to look like. There is no way to describe a FortiGate-shaped
CEF record without naming FortiGate. No vendor logos, stylized marks, or brand
assets are used anywhere in this repository.

Replicant emits SYNTHETIC log records. They are fabricated text that describes
events which did not occur, on devices that do not exist, using addresses drawn
from RFC 1918 and the IANA documentation ranges. They are not captured from, and
are not representative of, any vendor's product output in a customer
environment. Every run writes a manifest recording exactly what was generated.

The vendor reference documents under docs/ were written from each vendor's
public documentation, cited in each file's Sources section. Sample lines in
those documents and the golden lines in the test suite are marked [Constructed]:
they are assembled from the documented field and format rules rather than copied
from the vendors' published examples. See
docs/prior-art-and-licensing.md section 3 for the verification of that claim.

-------------------------------------------------------------------------------
Bundled third-party components and assets
-------------------------------------------------------------------------------
The web UI ships the following third-party works.

Geist (sans), self-hosted as .woff2 under webui/public/fonts. Copyright 2024
The Geist Project Authors. Licensed under the SIL Open Font License,
Version 1.1 (full text: webui/public/fonts/OFL-Geist.txt).
  https://github.com/vercel/geist-font

webui/public/war-room-bg.webp is an AI-generated abstract backdrop (no source
material with independent authorship), created for this project with Google's
Nano Banana 2 model via Higgsfield and edited (resized, recompressed) here.

JetBrains Mono, self-hosted as .woff2 under webui/public/fonts. Copyright 2020
The JetBrains Mono Project Authors. Licensed under the SIL Open Font License,
Version 1.1 (full text: webui/public/fonts/OFL-JetBrainsMono.txt).
  https://github.com/JetBrains/JetBrainsMono

shadcn/ui component patterns, adapted into webui/src/components/ui/* and the
`cn` helper in webui/src/lib/utils.ts. Copyright 2023 shadcn. MIT License.
  https://ui.shadcn.com
These components wrap Radix UI primitives (Copyright Radix UI, WorkOS; MIT
License; https://www.radix-ui.com), which are declared npm dependencies rather
than vendored source.

-------------------------------------------------------------------------------
Design acknowledgements
-------------------------------------------------------------------------------
Replicant's design was informed by the open-source projects below. No code from
these projects is bundled in this repository at this time. If permissively
licensed code is incorporated later, its required attribution notice will be
added to this section.

  - Atomic Red Team (Red Canary), MIT: technique-catalog structure.
  - Splunk Eventgen, Apache-2.0: token and distribution templating patterns.
  - Cisco Talos EvidenceForge, MIT: canonical-event model and emitter pattern.
  - flowsynth (OISF), Apache-2.0: plan-to-emitter pipeline pattern.

Prior art that shaped the design and is credited without code reuse:
  - summved/log-generator (GPL-3.0): CEF-over-syslog streaming with ATT&CK chains.