diff --git a/dectrax/1.0.0/Dockerfile b/dectrax/1.0.0/Dockerfile
new file mode 100644
index 00000000..85372ebb
--- /dev/null
+++ b/dectrax/1.0.0/Dockerfile
@@ -0,0 +1,23 @@
+# Base our app image off of the WALKOFF App SDK image
+FROM frikky/shuffle:app_sdk as base
+
+# We're going to stage away all of the bloat from the build tools so lets create a builder stage
+FROM base as builder
+
+# Install all alpine build tools needed for our pip installs
+RUN apk --no-cache add --update alpine-sdk libffi libffi-dev musl-dev openssl-dev
+
+# Install all of our pip packages in a single directory that we can copy to our base image later
+RUN mkdir /install
+WORKDIR /install
+COPY requirements.txt /requirements.txt
+RUN pip install --prefix="/install" -r /requirements.txt
+
+# Switch back to our base image and copy in all of our built packages and source code
+FROM base
+COPY --from=builder /install /usr/local
+COPY src /app
+
+# Finally, lets run our app!
+WORKDIR /app
+CMD python app.py --log-level DEBUG
diff --git a/dectrax/1.0.0/README.md b/dectrax/1.0.0/README.md
new file mode 100644
index 00000000..228ba17f
--- /dev/null
+++ b/dectrax/1.0.0/README.md
@@ -0,0 +1,156 @@
+# DECTRAX Shuffle SOAR App
+
+Official open-source integration app for [Shuffle SOAR](https://shuffler.io) to automate active cyber deception, canary honeytoken provisioning, and line-rate firewall containment with **DECTRAX**.
+
+[![App Version](https://img.shields.io/badge/version-1.0.0-blue.svg)](api.yaml)
+[![License](https://img.shields.io/badge/license-Apache--2.0-yellow.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
+[![Category](https://img.shields.io/badge/category-Deception%20%7C%20Incident%20Response-red.svg)](https://dectrax.com)
+
+---
+
+## Overview
+
+DECTRAX delivers enterprise cyber deception with **0.00% false positive fidelity** and **sub-1.5 second automated firewall interdiction**. 
+
+Unlike conventional SIEM correlation rules that burden analysts with ambiguous alerts and 45+ minute triage queues, DECTRAX operates synthetic decoy assets (LDAP, RDP, SSH, SMB, SQL, Web) that have zero legitimate business usage. Any interaction is a mathematically confirmed intrusion.
+
+This Shuffle app enables security engineers and MSSP SOC teams to orchestrate end-to-end autonomous response workflows directly within Shuffle:
+* **Instant Line-Rate Quarantine**: Automatically inject adversary IPs into DECTRAX's live External Dynamic List (EDL) feed consumed by Palo Alto, Fortinet, Check Point, pfSense, and Linux `nftables` firewalls.
+* **Blocklist Auditing**: Programmatically inspect and verify active perimeter blocks across multi-tenant environments.
+* **Deception Telemetry Triage**: Ingest high-fidelity breach forensics into Shuffle incident queues, tickets, and communication channels.
+* **On-Demand Honeytoken Provisioning**: Automatically generate and distribute synthetic AWS keys, database credentials, JWTs, and Kerberos SPNs to detect insider threats and lateral movement.
+
+---
+
+## Authentication & Configuration
+
+1. In the Shuffle Workflow Editor, add the **dectrax** app node.
+2. Select or create an authentication credential:
+   * **Parameter Name**: `apikey` (or configure via HTTP Header `Authorization: Bearer <API_KEY>`)
+   * **Value**: Your DECTRAX API Bearer Token generated from the DECTRAX Management Console (`Settings -> API Keys`).
+3. (Optional) Provide `base_url` if running a dedicated on-premise DECTRAX controller (default: `https://api.dectrax.com`).
+
+---
+
+## Actions Reference
+
+### 1. `block_ip`
+Publishes a confirmed attacker IP into DECTRAX's live External Dynamic List (EDL) feed for immediate sub-1.5s firewall drops.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `ip` (*string, required*): Malicious attacker IPv4 address to quarantine (e.g., `198.51.100.42`).
+  * `reason` (*string, optional*): Justification note (default: `Shuffle SOAR Automated Interdiction`).
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "message": "IP 198.51.100.42 added to active firewall EDL",
+  "ip": "198.51.100.42",
+  "interdiction_time_ms": 12
+}
+```
+
+---
+
+### 2. `get_blocked_ips`
+Fetches the current active newline-delimited firewall blocklist consumed by perimeter edge devices.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "count": 2,
+  "blocked_ips": [
+    "198.51.100.42",
+    "203.0.113.15"
+  ]
+}
+```
+
+---
+
+### 3. `get_recent_threats`
+Retrieves forensic threat records and honeypot interaction telemetry with 0.00% false positive accuracy.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `limit` (*integer, optional*): Maximum events to return (default: `50`).
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "count": 1,
+  "events": [
+    {
+      "timestamp": "2026-10-21T02:45:10Z",
+      "source_ip": "198.51.100.42",
+      "decoy_service": "RDP",
+      "destination_port": 3389,
+      "severity": "CRITICAL",
+      "raw_payload": "Negotiate NTLMSSP Challenge/Response",
+      "mitre_technique": "T1110.001"
+    }
+  ]
+}
+```
+
+---
+
+### 4. `generate_honeytoken`
+Provisions synthetic canary tokens (AWS access keys, database credentials, JWTs, Kerberos SPNs) on demand.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `token_type` (*string, optional*): One of `aws_key`, `database_creds`, `jwt_token`, `kerberos_spn` (default: `aws_key`).
+  * `memo` (*string, optional*): Location or host note (default: `Shuffle Automated Deployment`).
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "token_id": "canary-9f82d1",
+  "token_type": "aws_key",
+  "credentials": {
+    "access_key_id": "AKIAIOSFODNN7EXAMPLE",
+    "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+  },
+  "memo": "Finance-DB-AppServer-01"
+}
+```
+
+---
+
+## Example Shuffle Workflow
+
+### Automated Decoy Breach Interdiction Playbook:
+```
+[Webhook / Schedule Trigger]
+            │
+            ▼
+[DECTRAX: get_recent_threats] ─── (Iterate over new CRITICAL threat events)
+            │
+            ▼
+[DECTRAX: block_ip] ──────────── (Line-rate drop on Palo Alto / Fortinet EDL in <1.5s)
+            │
+            ▼
+[Slack / Microsoft Teams] ────── (Notify SOC: "Decoy RDP breach from 198.51.100.42 quarantined")
+```
+
+---
+
+## Support & Enterprise Contact
+
+* **Publisher**: DECTRAX Security Engineering
+* **Website**: [https://dectrax.com](https://dectrax.com)
+* **Technical Inquiries**: `support@dectrax.com`
+* **License**: Apache License 2.0
diff --git a/dectrax/1.0.0/api.yaml b/dectrax/1.0.0/api.yaml
new file mode 100644
index 00000000..b89640db
--- /dev/null
+++ b/dectrax/1.0.0/api.yaml
@@ -0,0 +1,113 @@
+app_version: 1.0.0
+name: dectrax
+description: Autonomous Cyber Deception, Honeytokens, and Line-Rate Firewall Interdiction for Shuffle SOAR
+contact_info:
+  name: DECTRAX Security Engineering
+  url: https://dectrax.com
+  email: support@dectrax.com
+tags:
+  - Deception
+  - Incident Response
+  - Threat Intelligence
+  - Firewall
+categories:
+  - Network
+  - Eradication
+  - Intelligence
+large_image: ""
+authentication:
+  required: true
+  parameters:
+    - name: apikey
+      description: DECTRAX API Bearer Token
+      example: "sec_tok_live_demo_98234"
+      required: true
+      schema:
+        type: string
+actions:
+  - name: block_ip
+    description: Automatically publishes an attacker IP into the DECTRAX External Dynamic List (EDL) feed for immediate sub-1.5s perimeter drop across Palo Alto, Fortinet, and Linux firewalls.
+    parameters:
+      - name: ip
+        description: Malicious attacker IPv4 address to quarantine
+        required: true
+        example: "198.51.100.42"
+        schema:
+          type: string
+      - name: reason
+        description: Incident justification or trigger identifier
+        required: false
+        example: "Shuffle SOAR Automated Interdiction"
+        default: "Shuffle SOAR Automated Interdiction"
+        schema:
+          type: string
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object
+  - name: get_blocked_ips
+    description: Fetches the current newline-delimited external dynamic list consumed by Linux nftables, Palo Alto Networks, and Fortinet firewalls.
+    parameters:
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object
+  - name: get_recent_threats
+    description: Retrieves high-fidelity honeypot breach events and attacker TTPs with deterministic 0.00% false positive accuracy.
+    parameters:
+      - name: limit
+        description: Maximum number of events to retrieve
+        required: false
+        example: 50
+        default: 50
+        schema:
+          type: integer
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object
+  - name: generate_honeytoken
+    description: Provisions on-demand canary credentials, decoy AWS access keys, or fake Kerberos SPNs to plant across production hosts.
+    parameters:
+      - name: token_type
+        description: Type of synthetic canary asset to generate (aws_key, database_creds, jwt_token, kerberos_spn)
+        required: false
+        example: "aws_key"
+        default: "aws_key"
+        schema:
+          type: string
+      - name: memo
+        description: Deployment location notes or host identifier
+        required: false
+        example: "Shuffle Automated Deployment"
+        default: "Shuffle Automated Deployment"
+        schema:
+          type: string
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object
diff --git a/dectrax/1.0.0/requirements.txt b/dectrax/1.0.0/requirements.txt
new file mode 100644
index 00000000..0eb8cae7
--- /dev/null
+++ b/dectrax/1.0.0/requirements.txt
@@ -0,0 +1 @@
+requests>=2.31.0
diff --git a/dectrax/1.0.0/src/app.py b/dectrax/1.0.0/src/app.py
new file mode 100644
index 00000000..2362d5c0
--- /dev/null
+++ b/dectrax/1.0.0/src/app.py
@@ -0,0 +1,183 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import os
+import sys
+import requests
+import json
+
+try:
+    from walkoff_app_sdk.app_base import AppBase
+except ImportError:
+    try:
+        from shuffle_sdk import AppBase
+    except ImportError:
+        # Fallback for local testing, CI pipelines, and standalone execution
+        class AppBase:
+            def __init__(self, redis=None, logger=None, console_logger=None):
+                self.redis = redis
+                self.logger = logger
+                self.console_logger = console_logger
+
+            @classmethod
+            def run(cls):
+                print(f"Running {cls.__name__} in standalone mode")
+
+
+class DECTRAX(AppBase):
+    """
+    DECTRAX Shuffle SOAR App
+    Enables autonomous cyber deception, honeytoken provisioning, and line-rate firewall interdiction.
+    """
+    __version__ = "1.0.0"
+    app_name = "dectrax"
+
+    def __init__(self, redis=None, logger=None, console_logger=None):
+        super().__init__(redis, logger, console_logger)
+
+    def block_ip(self, apikey, ip, reason="Shuffle SOAR Automated Interdiction", base_url="https://api.dectrax.com"):
+        """
+        Publishes a confirmed adversary IP into DECTRAX's live External Dynamic List (EDL) feed
+        for automated perimeter/internal firewall drops in <1.5s.
+        """
+        clean_base = base_url.rstrip("/")
+        headers = {
+            "Authorization": f"Bearer {apikey}",
+            "Content-Type": "application/json",
+            "User-Agent": "DECTRAX-Shuffle-SOAR/1.0"
+        }
+        payload = {
+            "ip": ip.strip(),
+            "reason": reason
+        }
+        try:
+            res = requests.post(
+                f"{clean_base}/api/v1/edl/block",
+                json=payload,
+                headers=headers,
+                timeout=10
+            )
+            if res.status_code == 200:
+                try:
+                    return res.json()
+                except ValueError:
+                    return {"status": "success", "message": res.text, "ip": ip}
+            else:
+                return {
+                    "status": "error",
+                    "code": res.status_code,
+                    "message": res.text
+                }
+        except requests.exceptions.RequestException as e:
+            return {"status": "error", "message": f"Network exception communicating with DECTRAX: {str(e)}"}
+        except Exception as e:
+            return {"status": "error", "message": str(e)}
+
+    def get_blocked_ips(self, apikey, base_url="https://api.dectrax.com"):
+        """
+        Retrieves the current active firewall blocklist consumed by Palo Alto, Fortinet, and nftables.
+        """
+        clean_base = base_url.rstrip("/")
+        headers = {
+            "Authorization": f"Bearer {apikey}",
+            "User-Agent": "DECTRAX-Shuffle-SOAR/1.0"
+        }
+        try:
+            res = requests.get(
+                f"{clean_base}/api/v1/edl/firewall.txt",
+                headers=headers,
+                timeout=10
+            )
+            if res.status_code == 200:
+                ips = [line.strip() for line in res.text.splitlines() if line.strip() and not line.startswith("#")]
+                return {
+                    "status": "success",
+                    "count": len(ips),
+                    "blocked_ips": ips
+                }
+            else:
+                return {
+                    "status": "error",
+                    "code": res.status_code,
+                    "message": res.text
+                }
+        except requests.exceptions.RequestException as e:
+            return {"status": "error", "message": f"Network exception communicating with DECTRAX: {str(e)}"}
+        except Exception as e:
+            return {"status": "error", "message": str(e)}
+
+    def get_recent_threats(self, apikey, limit=50, base_url="https://api.dectrax.com"):
+        """
+        Fetches high-fidelity deception breach events and attacker TTPs with 0.00% false positive accuracy.
+        """
+        clean_base = base_url.rstrip("/")
+        headers = {
+            "Authorization": f"Bearer {apikey}",
+            "User-Agent": "DECTRAX-Shuffle-SOAR/1.0"
+        }
+        params = {"limit": int(limit)}
+        try:
+            res = requests.get(
+                f"{clean_base}/api/attacks/recent",
+                headers=headers,
+                params=params,
+                timeout=10
+            )
+            if res.status_code == 200:
+                try:
+                    data = res.json()
+                    return data
+                except ValueError:
+                    return {"status": "success", "raw": res.text}
+            else:
+                return {
+                    "status": "error",
+                    "code": res.status_code,
+                    "message": res.text
+                }
+        except requests.exceptions.RequestException as e:
+            return {"status": "error", "message": f"Network exception communicating with DECTRAX: {str(e)}"}
+        except Exception as e:
+            return {"status": "error", "message": str(e)}
+
+    def generate_honeytoken(self, apikey, token_type="aws_key", memo="Shuffle Automated Deployment", base_url="https://api.dectrax.com"):
+        """
+        Provisions synthetic canary tokens (AWS access keys, database credentials, JWTs, Kerberos SPNs)
+        to seed across high-value servers, GitHub repositories, or Active Directory.
+        """
+        clean_base = base_url.rstrip("/")
+        headers = {
+            "Authorization": f"Bearer {apikey}",
+            "Content-Type": "application/json",
+            "User-Agent": "DECTRAX-Shuffle-SOAR/1.0"
+        }
+        payload = {
+            "token_type": token_type,
+            "memo": memo
+        }
+        try:
+            res = requests.post(
+                f"{clean_base}/api/v1/canary/generate",
+                json=payload,
+                headers=headers,
+                timeout=10
+            )
+            if res.status_code == 200:
+                try:
+                    return res.json()
+                except ValueError:
+                    return {"status": "success", "raw": res.text}
+            else:
+                return {
+                    "status": "error",
+                    "code": res.status_code,
+                    "message": res.text
+                }
+        except requests.exceptions.RequestException as e:
+            return {"status": "error", "message": f"Network exception communicating with DECTRAX: {str(e)}"}
+        except Exception as e:
+            return {"status": "error", "message": str(e)}
+
+
+if __name__ == "__main__":
+    DECTRAX.run()