IDPS-ESCAPE turns detection into action. It combines signature-based engines (Wazuh, Suricata) with machine learning anomaly detection to catch both known and emerging threats — then automatically fires risk-scaled responses, from alert emails to host isolation, enriched with live cyber threat intelligence. Incident cases are created automatically, closing the loop from detection to remediation. Built for SMEs, SOC teams, and CERT/CSIRT entities under the CyFORT project.
RRCF-based behavioral and signature detection, now built around a manager-centric architecture with a programmatic wazuh_api module. Tiered active responses scale automatically to computed risk level.
Microsoft MTAD-GAT multivariate time-series anomaly detection on Wazuh alerts. Scenario-driven YAML configuration, offline debug mode, and direct RADAR data shipping in Wazuh.
Three-layer defense in depth: Wazuh/Suricata signature rules catch known patterns, RADAR (RRCF) detects behavioral anomalies, and SONAR (MTAD-GAT) identifies multivariate ML anomalies.
SATRAP-DL's DECIPHER subsystem queries MISP IOC feeds for blacklisted IPs, malicious domains, and hash indicators. The resulting CTI score T is fused into the normalized risk score R.
Incident cases are created automatically by DECIPHER in Flowintel when risk thresholds are crossed. Alert emails include the case URL, risk score breakdown, and full IOC context.
Enrichment logic (GeoIP, web) now lives in the Wazuh manager instead of per-endpoint helpers. Onboarding, group assignment, enrollment hardening, and scenario teardown are all driven by scripted manager entrypoints (radar.sh, bootstrap-agent.sh) — no Ansible required.
Browser-based Flask interface for the full RADAR operational lifecycle: configure connectors, tune risk weights and tier thresholds per scenario, and drive the Deployment page's Scenario Management, Anomaly Detector, Agent Management, Group Management, Status, and Teardown tabs — each deploy action paired with a matching undo action.
Wazuh agents and Suricata sensors collect logs, network events, and endpoint telemetry, feeding the OpenSearch indexer in real time.
SONAR (MTAD-GAT multivariate ML) and RADAR (RRCF behavioral) detect anomalies. Wazuh rules simultaneously match known signature attack patterns.
The RADAR risk engine fuses anomaly intensity A, signature risk S, and DECIPHER CTI score T into a weighted R = wₐ·A + wₛ·S + wₜ·T, assigning a Low, Medium, or High response tier.
Active responses fire automatically: email alerts, Flowintel incident case creation, and strong actions (IP block, host isolation, credential disable) scaled to the risk tier.
DECIPHER queries MISP IOC feeds to keep threat intelligence current. Flowintel accumulates case history and SONAR models are retrained with fresh alert evidence.
