SATRAP-DL, short for Semi-Automated Threat Reconnaissance and Analysis Powered by DECIPHER Logic, offers a suite of tools for computer-aided cyber-threat intelligence (CTI) analysis and automated incident handling informed by CTI.
For a visual stakeholder-oriented tour of SATRAP-DL, visit the product presentation page.
- SATRAP-DL suite
- Quick map
- Getting started
- Documentation and technical specifications
- License
- Acknowledgments
- Contact
-
SATRAP provides a platform for (semi-)automated analysis of CTI based on a knowledge representation system for explainable inference. It aims to reduce the manual effort involved in correlating threat intelligence and deriving actionable conclusions, while keeping the analysis over STIX 2.1 CTI data traceable.
-
DECIPHER provides an extensible REST service for real-time analysis and severity scoring of alert information and incident case creation for streamlined investigations of threat scenarios.
-
PyFlowintel is a Python library for interacting with the case management platform Flowintel through its REST API. PyFlowintel is used to support automated pipelines in DECIPHER.
This repository contains the source code, technical specifications, and user documentation of SATRAP-DL, developed based on the C5-DEC SSDLC methodology and associated C5-DEC CAD software.
The repository is organized as follows:
- satrap/: SATRAP Python package (KRS, ETL, CLI, analysis toolbox)
- decipher/: DECIPHER Python package (analysis REST service)
- deployment/: artifacts to deploy the operational environments of DECIPHER and SATRAP
- docs/: user manuals, notebooks, specs, and traceability artifacts
- tests/: unit and integration tests
- tutorials/: workshop and tutorial materials
- .devcontainer/: VS Code configuration for a ready-to-use containerized development environment.
The PyFlowintel library is hosted in a separate repository.
For detailed setup and usage instructions of each sub-system, please refer to the corresponding SATRAP or DECIPHER README.
For deploying a containerized development environment for the whole SATRAP-DL project in Visual Studio Code ... See the installation section in the user manual for details.
The repository includes a single script to run tests for both SATRAP and DECIPHER.
- Run all tests (SATRAP + DECIPHER)
./run_tests.sh- Run only either SATRAP or DECIPHER tests
./run_tests.sh <satrap|decipher>- Run individual test modules, classes and cases using the
unittestmodule. For example:
python -m unittest tests.satrap.file_util_testSee the README files of each project for more details about the test suites.
The technical specifications of SATRAP-DL including requirements, architecture design, software design and test artifacts, are available on a dedicated traceability web page.
See the SATRAP-DL user manual for usage guidance on each component of the suite.
Copyright (c) itrust Abstractions Lab and itrust consulting. All rights reserved.
SATRAP-DL is licensed under the GNU Affero General Public License (AGPL) v3.0 license.
Note: SATRAP incorporates a few ideas concerning the inference rules and the analysis functionality from typedb-cti (2.x), an open-source project licensed under Apache License 2.0. During the conceptual phase of SATRAP-DL, we considered building SATRAP on top of typedb-cti as they are close in spirit. However, we opted for a fresh development mainly for two reasons:
- the design of typedb-cti was not compatible with the ambitions and architectural requirements of SATRAP
- typedb-cti (2.x) relies on an outdated version of TypeDB 2.x, incompatible with the latest release at the time (2.27).
SATRAP-DL is a sub-project of CyFORT, "Cloud Cybersecurity Fortress of Open Resources and Tools for Resilience", co-funded by the Ministry of the Economy of Luxembourg in the context of the EC-approved IPCEI-CIS project.
For more information about the project, feedback, questions or feature requests, feel free to contact us at Abstractions Lab: info@abstractionslab.lu
Community feedback is welcome!