1. A test tool comprising: a hardware processor; a connection engine implemented by the hardware processor and configured to connect to a first non-relational database, a second non-relational database, and a server, the first non-relational database is flushed periodically; a transformation engine implemented by the hardware processor and configured to: receive a first message from the first non-relational database, the first message comprises a name of a first column of a table in the first non-relational database, a type of the first column, and a first plurality of values stored in the first column, a value of the first plurality of values indicating whether a network intrusion is detected; receive a second message from the second non-relational database, the second message comprises a name of a second column of a table in the second non-relational database, a type of the second column, and a second plurality of values stored in the second column; and transform the second message into a JavaScript Object Notation message; a validation engine implemented by the hardware processor and configured to: compare the first message with a server log stored on the server; determine, based on the comparison of the first message with the server log, that the server log includes a value that does not match any of the first plurality of values stored in the first column; compare the JavaScript Object Notation message with the server log; determine, based on the comparison of the JavaScript Object Notation message with the server log, that the JavaScript Object Notation message includes an error; in response to the determination that the server log includes a value that does not match any of the first plurality of values stored in the first column and the determination that the JavaScript Object Notation message includes the error, determine that a security tool is malfunctioning; a messaging engine implemented by the hardware processor and configured to communicate a message indicating that the server log includes a value that does not match any of the first plurality of values stored in the first column and that the second message contains the error, wherein a remedial action is performed in response to the message to repair the malfunctioning security tool.