|
 |
|
|
|
We are happy to announce new open-source releases: IDPS-ESCAPE has reached its first stable version and has since been upgraded to v2.1.0, SATRAP-DL has reached its first stable version (v1.0), and we introduce VECTOR from project PQC-MAT, a new toolkit to prepare the migration to post-quantum cryptography.
IDPS-ESCAPE (v1.0 → v2.1.0) has moved from research prototype to production-ready platform:
v1.0 – stable release — the RADAR web control panel, Ruleset-as-Code (version-controlled detection rules deployed through a GitHub Actions pipeline), new GeoIP and off-hour login detection, and hardened RADAR container images
v1.1 — a new web scanning detection scenario for Apache and Nginx access logs
v2.0 — a redesigned RADAR deployment: enrichment moved to the Wazuh manager, one-step endpoint enrolment with short-lived tokens, reversible deployment steps, and no more Ansible requirement
v2.1.0 — RADAR is now deployable on existing Wazuh installations and hardened for production use (authenticated control panel, per-deployment credentials, trusted alert sources, protected critical addresses and services), with a more robust DECIPHER integration: RADAR keeps detecting and responding even when CTI enrichment is unavailable
SATRAP-DL (v1.0) reaches its first stable version, following its alpha (March 2025) and beta (March 2026) releases:
Flowintel template repository integration — incident templates are now managed centrally in Flowintel (v3.1.0 and later) instead of within DECIPHER, giving organisations a single source of templates
Extended testing and complete documentation — new unit and integration tests covering the Flowintel integration points, full user manuals for SATRAP and DECIPHER, and updated technical specifications
Stability and maintenance — bug fixes and code quality improvements for a stable and extensible core
VECTOR (VErified Cryptography and Transition via Observable Registry) is the first release (v0.1) of PQC-MAT, a new CyFORT sub-project carried out under the EU IPCEI-CIS initiative. With NIST’s first post-quantum standards (FIPS 203, 204 and 205)
published and “Harvest Now, Decrypt Later” threats in mind, it helps organisations take the first step of any post-quantum migration: knowing where their cryptography is.
TOR (Transition via Observable Registry) — the cryptographic inventory engine, generating standardised CycloneDX 1.6 Cryptographic Bills of Materials (CBOM) through a unified vector CLI
VECTOR-Code — static analysis of Python, C and C++ source code with CodeQL, cloc and cryptobom-forge
VECTOR-Network — conversion of testssl.sh and ZGrab2 scans into CBOMs, including detection of standalone and hybrid post-quantum KEMs such as X25519MLKEM768
VECTOR-Score — quantum risk classification of every algorithm against a catalogue aligned with NIST FIPS 203/204/205, BSI TR-02102-1 and ANSSI, with an annotated CBOM and a Markdown risk report
Verified cryptography — a demonstration of mathematically verified implementations with F*
Together, IDPS-ESCAPE and SATRAP-DL now run the full loop on existing Wazuh deployments: RADAR detects a threat → DECIPHER enriches it with live CTI → a risk score drives the automated response → a prioritised Flowintel incident case lands in the analyst’s queue. VECTOR extends our open-source offering to post-quantum readiness. Entirely open-source.