186 items across 5 document types — generated 2026-09-01
| UID | Title | Type | Importance | Urgency | Vm | Release | Active | Parent links |
|---|---|---|---|---|---|---|---|---|
MRS-001 | Semantic data model | A | 5 | 5 | R | Alpha | active | — |
MRS-010 | Removal of expired intelligence | F | 3 | 1 | T | FID | active | — |
MRS-011 | Ingestion of CTI in a standard format | F | 5 | 5 | T | Alpha | active | — |
MRS-012 | CyFORT CTI repository | F | 5 | 4 | R | Alpha | active | — |
MRS-013 | OSINT ingestion | F | 5 | 4 | I | FID | active | — |
MRS-014 | Automated CTI enrichment | F | 5 | 4 | T | Alpha | active | — |
MRS-015 | Semantic relations preservation | A | 5 | 5 | R | Alpha | active | — |
MRS-016 | Configuration management | F | 5 | 3 | T | Alpha | active | — |
MRS-017 | Conformance with user settings | F | 5 | 5 | T | Alpha | active | — |
MRS-018 | Automated reasoning | A | 5 | 5 | R | Alpha | active | — |
MRS-019 | Exporting inferred CTI | F | 5 | 4 | T | Beta | active | — |
MRS-002 | CTI knowledge base | A | 5 | 5 | R | Alpha | active | — |
MRS-020 | Interactive frontend | F | 5 | 5 | T | Alpha | active | — |
MRS-021 | Self-defined CTI queries | F | 5 | 5 | T | FID | active | — |
MRS-022 | Storage of CTI investigations | F | 5 | 5 | T | Alpha | active | — |
MRS-023 | Query parameterization | F | 5 | 5 | T | Alpha | active | — |
MRS-024 | CTI analysis | A | 5 | 5 | R | Alpha | active | — |
MRS-025 | SATRAP-DL service | F | 5 | 5 | T | Alpha | active | — |
MRS-026 | Query result viewer | F | 5 | 5 | T | Alpha | active | — |
MRS-027 | Frontend query status | F | 5 | 5 | T | Alpha | active | — |
MRS-028 | Native query execution | F | 5 | 5 | T | Alpha | active | — |
MRS-029 | Frontend design | C | 5 | 5 | I | Alpha | active | — |
MRS-003 | CTI SKB extensibility | A | 5 | 5 | R | Alpha | active | — |
MRS-030 | Frontend terminology | I | 5 | 5 | I | FID | active | — |
MRS-031 | Frontend STIX compliance | C | 5 | 5 | I | FID | active | — |
MRS-032 | User-controlled CTI curation | F | 3 | 2 | T | Alpha | active | — |
MRS-033 | File-based SKB update | F | 3 | 2 | T | Alpha | active | — |
MRS-034 | Frontend cross-platform support | A | 5 | 5 | T | Alpha | active | — |
MRS-037 | SATRAP as software library | A | 4 | 3 | I | Alpha | active | — |
MRS-039 | CTI SKB content: from IDPS-ESCAPE | F | 4 | 3 | T | Beta | active | — |
MRS-040 | CTI SKB content: organizational CTI | F | 4 | 4 | T | Beta | active | — |
MRS-041 | CTI SKB content: system blueprint | F | 5 | 4 | T | Beta | active | — |
MRS-042 | CyFORT CTI continuous analysis | F | 4 | 2 | T | Beta | active | — |
MRS-004 | SKB data model flexibility | A | 5 | 5 | R,T | Alpha | active | — |
MRS-043 | CyFORT CTI repository enrichment connector | F | 4 | 2 | T | Beta | active | — |
MRS-005 | CTI SKB content: public CTI knowledge | Q | 5 | 5 | R | Alpha | active | — |
MRS-006 | Domain-specific CTI | Q | 3 | 3 | R,I | FID | active | — |
MRS-007 | Semantic CTI and MITRE D3FEND | Q | 3 | 3 | R,I | FID | active | — |
MRS-008 | CTI SKB data integrity | Q | 5 | 5 | R | Alpha | active | — |
MRS-009 | Policy-driven automated SKB update | F | 4 | 4 | R | FID | active | — |
MRS-035 | Integration with open-source tools for incident handling | F | 4 | 5 | T | Beta | active | — |
MRS-058 | Automated alert triage and case escalation guided by CTI | F | 5 | 5 | T | Beta | active | — |
MRS-059 | Standalone incident escalation from an externally-computed triage score | F | 4 | 5 | T | Alpha | active | — |
MRS-060 | Multi-scenario threat coverage and extensibility | F | 4 | 4 | T | Beta | active | — |
MRS-038 | Platform-independent API | F | 5 | 2 | T | Beta, FID | active | — |
MRS-044 | Modular architecture | A | 5 | 5 | R | Alpha | active | — |
MRS-045 | STIX compliance | C | 5 | 5 | T | Alpha | active | — |
MRS-046 | C5-DEC compliance | C | 5 | 5 | I | Alpha | active | — |
MRS-051 | Open-source releases | Q | 5 | 5 | I | Alpha | active | — |
MRS-053 | Secure programming compliance | C | 5 | 5 | I, R | Alpha | active | — |
MRS-056 | Access control | S | 4 | 2 | T | Beta | active | — |
MRS-057 | Secure channels to the CyFORT ecosystem | S | 5 | 2 | T | FID | active | — |
MRS-SATRAP | SATRAP | — | — | — | — | — | active | — |
MRS-DECIPHER | DECIPHER | — | — | — | — | — | active | — |
MRS-NFun | Non-functional requirements | — | — | — | — | — | active | — |
| UID | Title | Type | Importance | Urgency | Vm | Release | Active | Parent links |
|---|---|---|---|---|---|---|---|---|
SRS-001 | Data modelling language | A | — | 5 | R | Alpha | active | MRS-001 MRS-015 |
SRS-010 | Database manager | A | — | 5 | R | Alpha | active | MRS-011 |
SRS-011 | Ingestion of organizational CTI | F | 4 | 4 | T | Beta | active | MRS-040 |
SRS-012 | Inference rules | F | — | 4 | A | Alpha | active | MRS-014 |
SRS-013 | STIX 2.1 data model | A | — | 5 | A | Alpha | active | MRS-015 |
SRS-014 | Native reasoning engine | A | — | 5 | R, I | Alpha | active | MRS-018 |
SRS-015 | Jupyter Notebook frontend | F | — | 3 | T | Alpha | active | MRS-020 MRS-022 MRS-023 MRS-025 MRS-026 MRS-027 MRS-029 MRS-034 |
SRS-017 | Integration of behavioral data | F | 4 | 3 | T | Beta | active | MRS-039 |
SRS-018 | Automated CTI analysis | F | 4 | 2 | T | Beta | active | MRS-042 |
SRS-019 | CTI export to STIX 2.1 | F | 5 | 4 | T | Beta | active | MRS-019 |
SRS-020 | System configuration file | Q | — | 3 | I | Alpha | active | MRS-044 |
SRS-002 | Database paradigm | A | — | 5 | R | Alpha | active | MRS-002 MRS-015 |
SRS-023 | CTI representation in STIX 2.1 | C | — | 5 | R, I | Alpha | active | MRS-045 |
SRS-033 | Functional ETL events logging | F | — | 3 | T | Alpha | active | MRS-053 |
SRS-034 | Detailed event logging | S | — | 3 | T | Beta | active | MRS-053 |
SRS-035 | Consistent logging format | C | — | 1 | T | FID | active | MRS-053 |
SRS-039 | TypeQL to STIX 2.1 transformer | F | 5 | 4 | T,I | Beta | active | MRS-019 |
SRS-041 | Configuration management mechanism | F | — | 2 | I | Alpha | active | MRS-016 MRS-017 |
SRS-042 | Command line interface (CLI) | F | — | 5 | T | Alpha | active | MRS-020 MRS-033 MRS-034 |
SRS-043 | TypeDB Studio | F | — | 5 | T | Alpha | active | MRS-020 MRS-028 MRS-029 MRS-032 |
SRS-045 | CTI analysis engine | A | 5 | 5 | R,I | Alpha | active | MRS-024 |
SRS-046 | CTI analysis toolbox | F,A | 5 | 5 | T,R | Alpha | active | MRS-023 MRS-025 MRS-037 |
SRS-003 | Semantic search | A | — | 5 | R | Alpha | active | MRS-002 |
SRS-047 | OSINT feeds configuration and catalog | F | 4 | 2 | R,I | FID | active | MRS-013 |
SRS-004 | Extensibility of the data model | A | — | 5 | R | Alpha | active | MRS-003 |
SRS-005 | NoSQL data model | A | — | 5 | R | Alpha | active | MRS-004 |
SRS-006 | Integration of common CTI | F | — | 5 | T | Alpha | active | MRS-005 |
SRS-007 | Semantic data integrity | S | — | 5 | R | Alpha | active | MRS-008 |
SRS-008 | ETL subsystem | A | — | 5 | R | Alpha | active | MRS-011 |
SRS-009 | ETL Transformer | A | — | 5 | R | Alpha | active | MRS-011 |
SRS-048 | DECIPHER infrastructure stack: deployment | F | 5 | 5 | T | Beta | active | MRS-035 |
SRS-051 | Threat scenario analysis: suspicious login | F | 4 | 4 | T | Beta | active | MRS-035 MRS-038 MRS-058 MRS-060 |
SRS-059 | Threat scenario analysis: suspicious web scanning | F | 4 | 4 | T | Stable | active | MRS-035 MRS-038 MRS-058 MRS-060 |
SRS-060 | Multi-phase attack identification | F | 4 | 3 | Test (T) | Stable | active | MRS-058 |
SRS-049 | DECIPHER REST service and API | F | 5 | 5 | T | Beta | active | MRS-035 MRS-038 MRS-058 MRS-059 |
SRS-050 | DECIPHER service: analysis endpoint | F | 5 | 5 | T | Beta | active | MRS-035 MRS-058 |
SRS-052 | Analysis endpoint: IOC search in MISP for CTI enrichment | F | 5 | 5 | T | Beta | active | MRS-035 MRS-058 |
SRS-053 | Analysis endpoint: CTI-driven scoring engine for MISP | F | 5 | 5 | T | Beta | active | MRS-058 |
SRS-054 | Analysis endpoint: optional creation of prioritized case | F | 4 | 3 | T | Beta | active | MRS-035 MRS-058 |
SRS-055 | DECIPHER service: incidents endpoint | F | 4 | 5 | T | Beta | active | MRS-035 MRS-038 MRS-059 |
SRS-057 | Runtime-configurable DECIPHER features | F | 5 | 4 | T | Beta | active | MRS-058 MRS-059 |
SRS-056 | Extensible analyzer framework | A | 4 | 5 | I | Beta | active | MRS-060 |
SRS-021 | Centralized logging | Q | — | 2 | I | All | active | MRS-044 |
SRS-031 | Code static analysis | S | 5 | 3 | I, A | FID | active | MRS-053 |
SRS-032 | Dependencies management | S | — | 5 | I | FID | active | MRS-053 |
SRS-036 | Log validation | S | — | 4 | I | FID | active | MRS-053 |
SRS-037 | Sensitive information | S | — | 5 | I | Alpha | active | MRS-053 |
SRS-038 | Software identification | F,S | — | 3 | T | All | active | MRS-053 |
SRS-040 | Authentication and authorization | S, A | 4 | 3 | I | Beta | active | MRS-056 |
SRS-058 | Encrypted data transport for external service connections | S | 4 | 3 | I | All | active | MRS-057 |
SRS-016 | API based on OAS | C | — | 2 | R | FID | active | MRS-038 |
SRS-044 | Open-source TIP integration | A | — | 5 | R | Alpha | active | MRS-012 MRS-039 |
SRS-022 | Centralized exception handling | Q | — | 5 | I | All | active | MRS-044 |
SRS-024 | Design and implementation principles | A, S, Q | — | 5 | R | Alpha | active | MRS-044 MRS-046 |
SRS-025 | Code readability | Q | — | 5 | I | All | active | MRS-046 |
SRS-026 | Public release | C | — | 3 | I | All | active | MRS-051 |
SRS-027 | Open-source licensing | C | — | 3 | A | All | active | MRS-051 |
SRS-028 | Input validation | S | — | 5 | I | FID | active | MRS-053 |
SRS-029 | Input sanitization | S | — | 5 | I | FID | active | MRS-053 |
SRS-030 | Resource management | S | — | 5 | I | All | active | MRS-053 |
SRS-SATRAP | SATRAP | — | — | — | — | — | active | — |
SRS-DECIPHER | DECIPHER | — | — | — | — | — | active | — |
SRS-NFun | Non-functional requirements | — | — | — | — | — | active | — |
| UID | Title | Active | Parent links |
|---|---|---|---|
ARC-015 | SATRAP context diagram | active | SRS-003 SRS-043 SRS-044 |
ARC-001 | SATRAP: System structure overview | active | SRS-001 SRS-002 SRS-008 SRS-010 SRS-011 SRS-012 SRS-014 SRS-015 SRS-017 SRS-045 SRS-046 |
ARC-002 | Logical view of SATRAP | active | SRS-001 SRS-002 SRS-008 SRS-010 SRS-011 SRS-014 SRS-015 SRS-017 SRS-021 SRS-022 SRS-045 SRS-046 |
ARC-003 | ETL high-level design | active | SRS-006 SRS-008 SRS-009 SRS-010 SRS-011 SRS-013 SRS-020 SRS-023 SRS-024 SRS-028 SRS-029 SRS-039 |
ARC-004 | ETL components | active | SRS-001 SRS-002 SRS-005 SRS-006 SRS-008 SRS-009 SRS-010 SRS-013 SRS-020 SRS-023 SRS-024 SRS-028 SRS-029 SRS-039 |
ARC-013 | CTI analysis subsystem design | active | SRS-045 SRS-046 |
ARC-014 | SATRAP command-line interface design | active | SRS-038 SRS-042 |
ARC-005 | DECIPHER context diagram | active | SRS-048 SRS-049 |
ARC-006 | DECIPHER infrastructure deployment diagram | active | SRS-048 SRS-058 |
ARC-007 | RADAR-DECIPHER pipeline overview | active | SRS-050 |
ARC-008 | DECIPHER microservice container diagram | active | SRS-049 SRS-056 SRS-057 |
ARC-009 | REST service: analysis endpoint interaction | active | SRS-052 SRS-054 SRS-056 |
ARC-010 | Analysis endpoint: scoring data flow diagram | active | SRS-053 |
ARC-012 | Analysis endpoint: support for suspicious login | active | SRS-051 |
ARC-011 | REST service: incident endpoint interaction | active | SRS-055 |
ARC-016 | Analysis endpoint: suspicious network/web scanning | active | SRS-059 |
ARC-SATRAP | SATRAP | active | — |
ARC-DECIPHER | DECIPHER | active | — |
| UID | Title | Active | Parent links |
|---|---|---|---|
SWD-015 | SATRAP package diagram | active | ARC-002 ARC-015 |
SWD-017 | SATRAP CLI class diagram | active | ARC-014 |
SWD-001 | Top-level ETL design | active | ARC-001 ARC-002 ARC-003 ARC-004 |
SWD-002 | STIX-specific ETL design | active | ARC-003 ARC-004 |
SWD-003 | ETL system flow | active | ARC-003 ARC-004 |
SWD-004 | TypeDB utilities | active | ARC-003 ARC-004 |
SWD-005 | Transformer class diagram | active | ARC-003 ARC-004 |
SWD-006 | Transformer flow | active | ARC-003 ARC-004 |
SWD-007 | ETL full class diagram | active | ARC-003 ARC-004 |
SWD-016 | CTI analysis class diagram | active | ARC-013 |
SWD-011 | DECIPHER REST service component diagram | active | ARC-008 |
SWD-012 | Analysis layer class diagram | active | ARC-008 |
SWD-008 | Analysis endpoint flow | active | ARC-009 |
SWD-010 | Analysis endpoint: `suspicious_login` request flow | active | ARC-012 |
SWD-013 | Incident endpoint class diagram | active | ARC-008 |
SWD-009 | Incident endpoint flow | active | ARC-011 |
SWD-014 | DECIPHER microservice data model | active | ARC-008 ARC-010 |
SWD-SATRAP | SATRAP | active | — |
SWD-DECIPHER | DECIPHER | active | — |
| UID | Title | Platform | Precondition | Execution type | Verification method | Release | Complexity | Test data | Version | Active | Parent links |
|---|---|---|---|---|---|---|---|---|---|---|---|
TST-001 | Verify data modelling artifacts | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Review of design (R) | alpha | 1 | see referenced files | 0.1 | active | SRS-001 SRS-002 SRS-003 SRS-004 SRS-005 |
TST-010 | Verify CTI SKB inference rules | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Analysis (A) | alpha | 5 | see referenced files | 0.1 | active | SRS-012 |
TST-011 | Test Jupyter notebook frontend | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Test (T) | alpha | 2 | see referenced files | 0.1 | active | SRS-015 |
TST-012 | Test ETL logging | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Test (T) | alpha | 2 | see referenced files | 0.1 | active | SRS-033 |
TST-013 | Inspect settings for CM | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Inspection (I) | alpha | 2 | see referenced files | 0.1 | active | SRS-041 |
TST-014 | Test command line interface (CLI) | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Test (T) | alpha | 2 | see referenced files | 0.1 | active | SRS-042 |
TST-017 | Verify open-source TIP integration | N/A | — | Manual | Review of design (R) | alpha | 1 | see referenced files | 0.1 | active | SRS-044 |
TST-018 | Verify release and licensing | N/A | — | Manual | Inspection (I) | alpha | 1 | see referenced files | 0.1 | active | SRS-026 SRS-027 |
TST-019 | Verify layered architecture of SATRAP | N/A | — | Manual | Review of design (R), Inspection (I) | alpha | 2 | N/A | 0.1 | active | SRS-015 SRS-045 SRS-046 |
TST-020 | Verify enforcement of semantic data integrity | N/A | — | Manual | Review of design (R), Analysis(A) | alpha | 4 | N/A | 0.1 | active | SRS-007 |
TST-002 | Verify software engineering practices | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Review of design (R) | alpha | 3 | see referenced files | 0.1 | active | SRS-024 |
TST-003 | Verify STIX and reasoning engine | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Review of design (R), Inspection (I) | alpha | 1 | see referenced files | 0.1 | active | SRS-014 SRS-023 |
TST-004 | Verify STIX 2.1-based data model | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Analysis (A) | alpha | 5 | see referenced files | 0.1 | active | SRS-013 |
TST-005 | Verify centralized management | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Inspection (I) | alpha | 2 | see referenced files | 0.1 | active | SRS-020 SRS-021 SRS-022 |
TST-006 | Verify code clarity | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Inspection (I) | alpha | 3 | see referenced files | 0.1 | active | SRS-025 |
TST-007 | Verify secure programming | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Inspection (I), Review of design (R) | alpha | 3 | see referenced files | 0.1 | active | SRS-028 SRS-029 SRS-030 SRS-032 SRS-036 SRS-037 |
TST-008 | Test setup + MITRE ATT&CK ingestion | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Test (T) | alpha | 2 | see referenced files | 0.1 | active | SRS-006 SRS-043 |
TST-009 | Verify ETL architecture | GNU/Linux (Dockerized SATRAP deployment environment) | — | Manual | Review of design (R) | alpha | 2 | see referenced files | 0.1 | active | SRS-008 SRS-009 SRS-010 |
TST-021 | Test containerized deployment | GNU/Linux distribution or any platform with a bash shell | — | Manual | Test (T) | Beta | 2 | N/A | 0.4 | active | SRS-048 |
TST-022 | Test DECIPHER REST service and API | GNU/Linux | — | Manual | Test (T) | Beta | 2 | N/A | 0.5 | active | SRS-049 |
TST-028 | Test analysis endpoint core behavior | GNU/Linux | — | Manual | Test (T) | Beta | 3 | N/A | 0.4 | active | SRS-050 SRS-057 |
TST-023 | Test full workflow of analysis endpoint | GNU/Linux, MISP, Flowintel | — | Manual | Test (T) | Beta | 4 | tests/decipher/runners/events_simulator.py | 0.4 | active | SRS-051 SRS-052 SRS-054 |
TST-024 | Test runtime-configurable DECIPHER features | GNU/Linux | — | Manual | Test (T) | Beta | 3 | see referenced files | 0.4 | active | SRS-053 SRS-057 |
TST-026 | Test analysis endpoint graceful degradation | GNU/Linux | — | Manual | Test (T) | Beta | 4 | tests/decipher/integration/events_simulator.py | 0.4 | active | SRS-051 SRS-052 SRS-054 |
TST-025 | Test incidents endpoint | GNU/Linux | — | Manual | Test (T) | Beta | 3 | see referenced files | 0.5 | active | SRS-055 |
TST-027 | Test extensible analyzer framework | Any | — | Manual | Inspection (I) | Beta | 5 | see referenced files | 0.4 | active | SRS-056 |
TST-030 | Test analysis scenario: suspicious web scanning | GNU/Linux, MISP, Flowintel | — | Manual | Test (T) | Stable | 3 | tests/decipher/data/web_scanning_events.json | 1.1 | active | SRS-059 |
TST-029 | Retrieve software identification details | GNU/Linux (Dockerized SATRAP deployment environment), Web browser, REST API client (e.g., curl) | — | Manual | Test (T) | Stable | 2 | N/A | 1.0 | active | SRS-038 |
TST-SATRAP | SATRAP validation tests | — | — | — | — | — | — | — | — | active | — |
TST-DECIPHER | DECIPHER validation tests | — | — | — | — | — | — | — | — | active | — |
TST-SATRAP-DL | SATRAP-DL validation tests | — | — | — | — | — | — | — | — | active | — |