{"id":2256,"date":"2026-05-08T20:07:23","date_gmt":"2026-05-08T20:07:23","guid":{"rendered":"https:\/\/abstractionslab.com\/?p=2256"},"modified":"2026-05-15T11:19:08","modified_gmt":"2026-05-15T11:19:08","slug":"satrap-dl-v1-0-now-on-github","status":"publish","type":"post","link":"https:\/\/abstractionslab.com\/index.php\/2026\/05\/08\/satrap-dl-v1-0-now-on-github\/","title":{"rendered":"SATRAP-DL v1.0 now on GitHub!"},"content":{"rendered":"\n

We are happy to announce the release of SATRAP-DL v1.0<\/mark><\/strong><\/a><\/strong>, a suite for intelligence-driven security operations.<\/p>\n\n\n\n

\"SATRAP-DL<\/a><\/figure>\n\n\n\n

What started as an Alpha release focused on knowledge representation has evolved into a suite of tools combining automated CTI analysis with real-time incident analysis, supporting detection, enrichment, and response orchestration workflows.<\/p>\n\n\n\n

SATRAP-DL is built entirely on open-source foundations and designed to integrate seamlessly into existing open-source security ecosystems: TypeDB for a knowledge base, STIX 2.1 for threat data representation, MISP as a threat intelligence platform, Flowintel for incident management and IDPS-ESCAPE for SOAR operations.<\/p>\n\n\n\n

From Alpha to v1.0<\/strong><\/h2>\n\n\n\n

With the release of SATRAP in March 2025, we made available for the open-source community a cyber threat intelligence analysis system built on a sound threat derivation approach: a knowledge representation system built on TypeDB underpins explainable, logic-based reasoning over STIX 2.1 threat data, accessible via a Python library of CTI functions.<\/p>\n\n\n\n

By the Beta release in March 2026, we added DECIPHER, extending SATRAP-DL to the operational boundary where security alerts meet intelligence-driven decision making relying on the integration with other open-source cybersecurity tools (MISP and Flowintel).<\/p>\n\n\n\n

Today, SATRAP-DL v1.0 introduces a stable and extensible core<\/strong>, ready to support tailored customization and varied organizational use cases<\/strong>. Beyond bugfixes, code quality improvements, testing, and documentation updates (technical and user oriented), this release integrates the use of the Flowintel’s central repository of templates, a recently added feature in the case management tool.<\/p>\n\n\n\n

What’s New in v1.0<\/strong><\/h2>\n\n\n\n

Flowintel Template Repository Integration<\/strong>
A dedicated repository of templates (supported from Flowintel v3.1.0) acts now as a centralized CyFORT incident templates library. This architectural refinement allows organizations to maintain a single source of truth directly in Flowintel<\/strong>, the dedicated incident management system, relieving DECIPHER from template management, thus, keeping a cleaner separation of concerns.<\/p>\n\n\n\n

Comprehensive Testing & Documentation<\/strong>
Expanded unit and integration tests<\/strong> covering the new Flowintel integration points, complete user manuals<\/strong> for both SATRAP and DECIPHER and updated technical specifications<\/strong> accessible via our traceability website<\/a>.<\/p>\n\n\n\n

The SATRAP-DL synergy<\/strong><\/h2>\n\n\n\n

SATRAP-DL assists you with automation of CTI at different layers:<\/p>\n\n\n\n

\n
\n

SATRAP<\/strong> remains your platform for offline, strategic threat understanding and in-depth CTI analysis:<\/p>\n\n\n\n