This manual provides detailed documentation for all IDPS-ESCAPE components implementing a comprehensive SOAR system following the MAPE-K paradigm (Monitor, Analyze, Plan, Execute, Knowledge).
Key subsystems: RADAR (automated response), SONAR (production anomaly detection), and ADBox (legacy research framework).
Hybrid detection approach: Signature-based (Wazuh, Suricata) + multivariate AD (SONAR) + streaming AD (RRCF via OpenSearch AD plugin).
| Quick start | Full documentation |
SONAR (SIEM-Oriented Neural Anomaly Recognition) is our production-grade multivariate time-series anomaly detection subsystem:
Use SONAR for all production deployments.
| Getting started | Full documentation |
The RADAR subsystem provides solutions for completing the SOAR mission of IDPS-ESCAPE:
⚠️ DEPRECATED: Use SONAR for production. ADBox maintained for research continuity only.
To achieve comprehensive monitoring capabilities, we combine Suricata, an open-source Network Intrusion Detection System (NIDS), and Wazuh, a cybersecurity platform that integrates SIEM and XDR capabilities; see the instructions for a joint deployment of IDPS, SIEM/XDR and OpenSearch AD.