IDPS-ESCAPE (Intrusion Detection and Prevention System - Enhanced Security through a Cooperative Anomaly Prediction Engine) is a sub-project of CyFORT implementing a MAPE-K-based (Monitor, Analyze, Plan, Execute, Knowledge) Security Orchestration, Automation, and Response (SOAR) system. Developed in the context of IPCEI-CIS, it targets SMEs, CERT/CSIRT entities, SOC managers, system administrators, security engineers and cloud deployments.
Core components:
- RADAR - Risk-aware hybrid detection and automated response, deployed and managed end-to-end from a point-and-click web GUI (backed by an API — no manual config editing needed)
- SONAR - SIEM-oriented multivariate anomaly detection powered by deep learning
- ADBox - Legacy research framework
- Wazuh integration and management: all components integrate fully with Wazuh, with RADAR additionally providing Wazuh management and orchestration
Built on: Wazuh, OpenSearch, SATRAP-DL, PyFlowintel, Flowintel, MISP, Suricata
We adopt a hybrid detection approach for defense-in-depth against known and emerging threats, combining signature-based engines (Wazuh, Suricata) and machine learning (ML) algorithms for ML-based anomaly detection (AD) through RADAR and SONAR, relying on RRCF (random forest) for streaming data and MTAD-GAT (attention mechanism and deep learning), respectively.
This repository contains complete documentation, user manual, interlinked technical specifications for traceability, and validation test results, all based on the C5-DEC method.
For a visual user-oriented tour of IDPS-ESCAPE, visit the product presentation page.
RADAR enhances Wazuh with hybrid detection and intelligent automated response through a fully API-based steering and management layer, following a scenario-based paradigm. Its browser-based GUI provides the complete deployment and operations experience on top of that API:
- Hybrid detection: Signature-based (Wazuh, Suricata) + ML-based anomaly detection (RRCF)
- Risk-aware actions: Tiered response (low/medium/high risk) with host isolation, process control, network rules, alert escalation, email notification and incident case creation
- Automatic case creation: Incident case creation via integration with the DECIPHER subsystem of SATRAP-DL, PyFlowintel and Flowintel
- Flexible deployment: Local/remote manager and agent configurations
- Production scenarios: Default baseline detection, GeoIP detection, log volume monitoring, suspicious login, web scanning detection
- Web-based GUI: provides a browser-based control panel covering the full deployment, orchestration and configuration lifecycle
See RADAR README, GUI user manual, scenarios, adversarial ML guidance and developer README.
SONAR provides a standalone SIEM-oriented anomaly detection solution based on deep learning:
- Multivariate time series AD engine: modular and optimized multivariate time-series detection based on MTAD-GAT
- Debug mode: Offline testing with synthetic data (no infrastructure required)
- Wazuh integration: Integrated with Wazuh, the open-source SIEM, for monitoring data ingestion and detection data provision and visualization
- Scenario-based: YAML configuration for repeatable workflows
- RADAR integration: SONAR data streams shipping to Wazuh for automated response and easy ingestion by RADAR
- Flexible modes: Real-time, batch, and historical analysis
See SONAR README, scenario guide, architecture and developer README.
RADAR provides a browser-based control panel for production-ready deployment and ongoing management of the Wazuh Manager, Wazuh Agents, and the full RADAR stack — no manual config files or CLI orchestration required. The GUI covers scenario deployment, agent onboarding, configuration, anomaly-detector setup, health checks, and teardown, giving full control over the stack from one place. See the GUI user manual for details.
See our user manual for comprehensive documentation on RADAR, and SONAR. Visit our traceability page for interlinked requirements, technical specifications such as architecture diagrams, and test reports.
⚠️ Legacy System: maintained for research continuity only. Use SONAR for deployments requiring deep learning.
See the ADBox manual for documentation.
Prerequisites:
Ensure your environment meets the resource and network requirements specified below, and then proceed as follows:
- Create
radar/.envand update relevant fields (use a copy env.example):- OpenSearch URL, username, password
- Wazuh API credentials and manager address
- SMTP settings for email alerts
- FlowIntel API key (optional, for incident case creation)
- Webhook URL (default:
http://<manager-ip>:8080/notify)
- Start the RADAR GUI using the
radar.shscript from within theradar/directory (after making it executablechmod +x ./radar.sh):
./radar.sh guiThen open the displayed local URL and use the Deployment page to deploy the full stack, onboard agents, configure scenarios, start anomaly detection, run health checks, and manage teardown. See the RADAR GUI user manual and getting started page for full details.
Screenshots depicting the various stages in a Suspicious Login detection and response event flow are provided below.
Suspicious login detection shown on the Wazuh dashboard:
Email notification sent by RADAR automated response:
DECIPHER lookup in MISP to compute CTI score (used in RADAR risk score):
Automatic incident case created in Flowintel using DECIPHER (subsystem of SATRAP-DL):
SONAR provides scenario-based anomaly detection with flexible execution modes:
# Install and connect to Wazuh
poetry install --only sonar
# Check Wazuh connection
poetry run sonar check
# Run complete scenario (train + detect)
poetry run sonar scenario --use-case sonar/scenarios/brute_force_detection.yaml
# Debug mode (offline testing with synthetic data)
poetry run sonar scenario --use-case sonar/scenarios/example_scenario.yaml --debug
# Production mode with data shipping to Wazuh (viewed in custom dashboard) and usable by RADAR
poetry run sonar scenario --use-case sonar/scenarios/my_scenario.yaml --shipSee the SONAR documentation for details.
Data shipping for Wazuh and RADAR integration:
What --ship does:
- Creates dedicated data streams in Wazuh Indexer for scenario-specific anomalies
- Enables custom dashboard creation in Wazuh
- Enables real-time monitoring and RADAR automated response integration
- Installs index templates for proper field typing and validation
- Required for production SONAR→RADAR workflows
See the data shipping guide for configuration details and the dashboard tutorial for visualization and instructions explaining how to build such a dashboard (same process for SONAR and ADBox).
No infrastructure required — debug mode runs the full train → detect → report workflow offline with synthetic data:
poetry install --with sonar
poetry run sonar scenario --use-case sonar/scenarios/example_scenario.yaml --debug| Component | RAM | Storage | CPU |
|---|---|---|---|
| Wazuh Manager | 8 GB minimum | ~15 GB | 4 cores |
| SONAR | 4 GB | ~2 GB (models) | 2 cores |
| RADAR | 2 GB | ~1 GB | 2 cores |
| Wazuh Agents | 512 MB each | ~500 MB each | 1 core |
| Full Stack | 16 GB+ | ~26 GB total | 8+ cores |
See the custom deployment guides for optional network requirements and multi-node setups.
Build and run with convenience scripts:
# Build images
./build.sh all # All components
./build.sh sonar # SONAR only
# Run SONAR
./sonar/sonar.sh check # Check Wazuh connection
./sonar/sonar.sh scenario --use-case sonar/scenarios/example_scenario.yaml --debug
# Run ADBox (legacy, see the ADBox manual)
./adbox/adbox.sh -u 1Note: Docker-based execution requires building the images first with build.sh.
# Install dependencies
poetry install --with sonar,radar,adbox,test
# Run tests
poetry run pytest tests/sonartests/ # SONAR
poetry run pytest tests/ # All
./radar/test.sh # RADAR
# SONAR CLI
poetry run sonar check
poetry run sonar scenario --use-case sonar/scenarios/example.yaml --debug
# Docker builds
./build.sh allSee SONAR README and RADAR README for component-specific development guides.
See our test report (TRP) in the list of published documents on the technical specifications traceability page detailing the validation test campaign results. Unit tests are available in the tests folder.
RADAR has been validated in controlled environments and is released as stable. SONAR is at most at TRL 6. Conduct a thorough security assessment before deploying either component in production. Use at your own risk.
Copyright © itrust Abstractions Lab and itrust consulting. Licensed under GNU AGPL v3.0. See AUTHORS for contributors.
Co-funded by the Ministry of the Economy of Luxembourg in the context of the CyFORT project.
Abstractions Lab: info@abstractionslab.lu