{"id":2142,"date":"2026-03-16T16:10:42","date_gmt":"2026-03-16T16:10:42","guid":{"rendered":"https:\/\/abstractionslab.com\/?p=2142"},"modified":"2026-03-17T10:14:14","modified_gmt":"2026-03-17T10:14:14","slug":"satrap-dl-v0-4-decipher-and-pyflowintel","status":"publish","type":"post","link":"https:\/\/abstractionslab.com\/index.php\/2026\/03\/16\/satrap-dl-v0-4-decipher-and-pyflowintel\/","title":{"rendered":"SATRAP-DL (v0.4): DECIPHER and PyFlowintel"},"content":{"rendered":"\n

We are happy to announce the Beta release of SATRAP-DL<\/mark><\/strong><\/a>!<\/p>\n\n\n\n

\"SATRAP-DL<\/a><\/figure>\n\n\n\n
\"<\/a><\/figure>\n\n\n\n

<\/p>\n\n\n\n

This update enriches the SATRAP-DL suite for intelligence-driven security operations with DECIPHER<\/strong> for automated incident handling, and PyFlowintel<\/strong>, a Python library for the Flowintel API.<\/p>\n\n\n\n

What is DECIPHER<\/mark><\/a>?<\/strong><\/h2>\n\n\n\n

DECIPHER<\/strong> (D<\/strong>etection, E<\/strong>nrichment, C<\/strong>orrelation, I<\/strong>ncident, P<\/strong>laybooks, H<\/strong>andling, E<\/strong>scalation and R<\/strong>ecovery) is an open-source REST microservice for automated analysis and severity-confidence scoring of security alerts, informed by cyber-threat intelligence.<\/p>\n\n\n\n

Where SATRAP<\/a> reasons over stored CTI to answer complex threat queries with explainable inference, DECIPHER acts at the operational boundary: it receives live security alerts, searches for related threat intelligence, computes a severity score, and hands off prioritized incident cases to analysts, without manual intervention.<\/p>\n\n\n\n

Together, SATRAP and DECIPHER form a unified suite for intelligence-driven threat analysis and automated incident handling when integrated with open-source tools such as the Wazuh-RADAR<\/a> subsystem of IDPS-ESCAPE<\/a>, the community-driven MISP<\/a> threat intelligence platform and the Flowintel<\/a> case management platform.<\/p>\n\n\n\n

key features<\/strong><\/h2>\n\n\n\n