# IDPS-ESCAPE v0.10, SATRAP-DL v0.5 and PyFlowintel v0.3

**URL:** <https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054>\
**Category:** hackathon.lu\
**Tags:** hackathon-2026\
**Created:** [April 14, 2026, 1:15pm UTC](https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054 "2026-04-14T13:15:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![CryptographySandbox](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/cryptographysandbox/32/50_2.png) [@CryptographySandbox](https://discourse.ossbase.org/u/CryptographySandbox)\
**Post date:** [April 14, 2026, 1:15pm UTC](https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054/1 "2026-04-14T13:15:42Z")

</div>

**IDPS-ESCAPE**

Preparing the next release of [IDPS-ESCAPE](https://github.com/AbstractionsLab/idps-escape), [SATRAP-DL](https://github.com/AbstractionsLab/satrap-dl) and [PyFlowintel](https://github.com/AbstractionsLab/PyFlowintel) with @gulsezim11 and @ivazsndv

- Validation of one SONAR scenario (probably resource usage)
- Validation of RADAR support for low-friction baseline threat detection (e.g. detection rules with no anomaly detection), aimed at rapid RADAR deployment without detailed scenario preparation
- Unified configuration for RADAR and RTF (RADAR Test Framework)
- Prototype of web management GUI for our Ansible-based RADAR deployment solution
- Integrate Wazuh ruleset as Code (RaC) added into RADAR to complement its already existing DaC-based model

**[SATRAP-DL](https://github.com/AbstractionsLab/satrap-dl)**

##### [PyFlowintel](https://github.com/AbstractionsLab/PyFlowintel)

- Share feedback on Flowintel with the respective team and define updates on PyFlowintel according to the discussion

- Release an update supporting the incomplete functionality in DECIPHER concerning the use of templates

##### [DECIPHER](https://github.com/AbstractionsLab/satrap-dl/tree/main/decipher)

- Update the deployment artifacts to support selecting the Flowintel version to deploy

- Discuss and study refinements to the CTI scoring formula based on other available taxonomies in MISP, object grouping and [MISP decaying models](https://github.com/MISP/misp-decaying-models)

---

<div class="post-metadata">

**Author:** ![gulsezim11](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/gulsezim11/32/585_2.png) [@gulsezim11](https://discourse.ossbase.org/u/gulsezim11)\
**Post date:** [April 15, 2026, 9:16am UTC](https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054/2 "2026-04-15T09:16:08Z")

</div>

The tasks that has been completed during the hackathon and prior:

1. Validation of RADAR support for low-friction baseline threat detection (e.g. detection rules with no anomaly detection), aimed at rapid RADAR deployment without detailed scenario preparation
2. Unified configuration for RADAR and RTF (RADAR Test Framework)

---

<div class="post-metadata">

**Author:** ![gulsezim11](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/gulsezim11/32/585_2.png) [@gulsezim11](https://discourse.ossbase.org/u/gulsezim11)\
**Post date:** [April 15, 2026, 2:11pm UTC](https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054/3 "2026-04-15T14:11:52Z")

</div>

> [@CryptographySandbox](#):
>
> Prototype of web management GUI for our Ansible-based RADAR deployment solution

The task has been accomplished.

---

<div class="post-metadata">

**Author:** ![gulsezim11](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/gulsezim11/32/585_2.png) [@gulsezim11](https://discourse.ossbase.org/u/gulsezim11)\
**Post date:** [April 15, 2026, 2:39pm UTC](https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054/4 "2026-04-15T14:39:49Z")

</div>

The result of the hackathon for IDPS-ESCAPE could be found at [idps-escape/CHANGELOG.md at main · AbstractionsLab/idps-escape · GitHub](https://github.com/AbstractionsLab/idps-escape/blob/main/CHANGELOG.md#010-2026-04-15)

---

<div class="post-metadata">

**Author:** ![CryptographySandbox](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/cryptographysandbox/32/50_2.png) [@CryptographySandbox](https://discourse.ossbase.org/u/CryptographySandbox)\
**Post date:** [April 15, 2026, 3:24pm UTC](https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054/5 "2026-04-15T15:24:50Z")

</div>

The status by the end:

- Validation of one SONAR scenario (probably resource usage)

- Validation of RADAR support for low-friction baseline threat detection (e.g. detection rules with no anomaly detection), aimed at rapid RADAR deployment without detailed scenario preparation

- Unified configuration for RADAR and RTF (RADAR Test Framework)

- Prototype of web management GUI for our Ansible-based RADAR deployment solution

- Integrate Wazuh ruleset as Code (RaC) added into RADAR to complement its already existing DaC-based model

##### [PyFlowintel](https://github.com/AbstractionsLab/PyFlowintel)

- Share feedback on Flowintel with the respective team and define updates on PyFlowintel according to the discussion

- Unit tests for the `case` endpoint (and create issues in the flowintel repo)

##### [DECIPHER](https://github.com/AbstractionsLab/satrap-dl/tree/main/decipher)

- Update the deployment artifacts to support selecting the Flowintel version to deploy

- Discuss and study refinements to the CTI scoring formula based on other available taxonomies in MISP, object grouping and [MISP decaying models](https://github.com/MISP/misp-decaying-models)

---

<div class="post-metadata">

**Author:** ![ivazsndv](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/ivazsndv/32/59_2.png) [@ivazsndv](https://discourse.ossbase.org/u/ivazsndv)\
**Post date:** [April 16, 2026, 7:51pm UTC](https://discourse.ossbase.org/t/idps-escape-v0-10-satrap-dl-v0-5-and-pyflowintel-v0-3/1054/6 "2026-04-16T19:51:19Z")

</div>

The updates to PyFlowintel and DECIPHER are summarized in the CHANGELOGs of [PyFlowintel v0.2.2](https://github.com/AbstractionsLab/PyFlowintel/blob/main/CHANGELOG.md#022-2026-04-16) and [SATRAP-DL v0.5.1](https://github.com/AbstractionsLab/satrap-dl/blob/main/CHANGELOG.md#051-2026-04-15)