[App Submission] DECTRAX: Autonomous Cyber Deception & Line-Rate Firewall Interdiction (v1.0.0)

dectrax/1.0.0/Dockerfile

@@ -0,0 +1,23 @@
+# Base our app image off of the WALKOFF App SDK image
+FROM frikky/shuffle:app_sdk as base
+
+# We're going to stage away all of the bloat from the build tools so lets create a builder stage
+FROM base as builder
+
+# Install all alpine build tools needed for our pip installs
+RUN apk --no-cache add --update alpine-sdk libffi libffi-dev musl-dev openssl-dev
+
+# Install all of our pip packages in a single directory that we can copy to our base image later
+RUN mkdir /install
+WORKDIR /install
+COPY requirements.txt /requirements.txt
+RUN pip install --prefix="/install" -r /requirements.txt
+
+# Switch back to our base image and copy in all of our built packages and source code
+FROM base
+COPY --from=builder /install /usr/local
+COPY src /app
+
+# Finally, lets run our app!
+WORKDIR /app
+CMD python app.py --log-level DEBUG

dectrax/1.0.0/README.md

@@ -0,0 +1,156 @@
+# DECTRAX Shuffle SOAR App
+
+Official open-source integration app for [Shuffle SOAR](https://shuffler.io) to automate active cyber deception, canary honeytoken provisioning, and line-rate firewall containment with **DECTRAX**.
+
+[![App Version](https://img.shields.io/badge/version-1.0.0-blue.svg)](api.yaml)
+[![License](https://img.shields.io/badge/license-Apache--2.0-yellow.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
+[![Category](https://img.shields.io/badge/category-Deception%20%7C%20Incident%20Response-red.svg)](https://dectrax.com)
+
+---
+
+## Overview
+
+DECTRAX delivers enterprise cyber deception with **0.00% false positive fidelity** and **sub-1.5 second automated firewall interdiction**. 
+
+Unlike conventional SIEM correlation rules that burden analysts with ambiguous alerts and 45+ minute triage queues, DECTRAX operates synthetic decoy assets (LDAP, RDP, SSH, SMB, SQL, Web) that have zero legitimate business usage. Any interaction is a mathematically confirmed intrusion.
+
+This Shuffle app enables security engineers and MSSP SOC teams to orchestrate end-to-end autonomous response workflows directly within Shuffle:
+* **Instant Line-Rate Quarantine**: Automatically inject adversary IPs into DECTRAX's live External Dynamic List (EDL) feed consumed by Palo Alto, Fortinet, Check Point, pfSense, and Linux `nftables` firewalls.
+* **Blocklist Auditing**: Programmatically inspect and verify active perimeter blocks across multi-tenant environments.
+* **Deception Telemetry Triage**: Ingest high-fidelity breach forensics into Shuffle incident queues, tickets, and communication channels.
+* **On-Demand Honeytoken Provisioning**: Automatically generate and distribute synthetic AWS keys, database credentials, JWTs, and Kerberos SPNs to detect insider threats and lateral movement.
+
+---
+
+## Authentication & Configuration
+
+1. In the Shuffle Workflow Editor, add the **dectrax** app node.
+2. Select or create an authentication credential:
+   * **Parameter Name**: `apikey` (or configure via HTTP Header `Authorization: Bearer <API_KEY>`)
+   * **Value**: Your DECTRAX API Bearer Token generated from the DECTRAX Management Console (`Settings -> API Keys`).
+3. (Optional) Provide `base_url` if running a dedicated on-premise DECTRAX controller (default: `https://api.dectrax.com`).
+
+---
+
+## Actions Reference
+
+### 1. `block_ip`
+Publishes a confirmed attacker IP into DECTRAX's live External Dynamic List (EDL) feed for immediate sub-1.5s firewall drops.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `ip` (*string, required*): Malicious attacker IPv4 address to quarantine (e.g., `198.51.100.42`).
+  * `reason` (*string, optional*): Justification note (default: `Shuffle SOAR Automated Interdiction`).
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "message": "IP 198.51.100.42 added to active firewall EDL",
+  "ip": "198.51.100.42",
+  "interdiction_time_ms": 12
+}
+```
+
+---
+
+### 2. `get_blocked_ips`
+Fetches the current active newline-delimited firewall blocklist consumed by perimeter edge devices.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "count": 2,
+  "blocked_ips": [
+    "198.51.100.42",
+    "203.0.113.15"
+  ]
+}
+```
+
+---
+
+### 3. `get_recent_threats`
+Retrieves forensic threat records and honeypot interaction telemetry with 0.00% false positive accuracy.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `limit` (*integer, optional*): Maximum events to return (default: `50`).
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "count": 1,
+  "events": [
+    {
+      "timestamp": "2026-10-21T02:45:10Z",
+      "source_ip": "198.51.100.42",
+      "decoy_service": "RDP",
+      "destination_port": 3389,
+      "severity": "CRITICAL",
+      "raw_payload": "Negotiate NTLMSSP Challenge/Response",
+      "mitre_technique": "T1110.001"
+    }
+  ]
+}
+```
+
+---
+
+### 4. `generate_honeytoken`
+Provisions synthetic canary tokens (AWS access keys, database credentials, JWTs, Kerberos SPNs) on demand.
+
+* **Parameters:**
+  * `apikey` (*string, required*): DECTRAX API Bearer Token.
+  * `token_type` (*string, optional*): One of `aws_key`, `database_creds`, `jwt_token`, `kerberos_spn` (default: `aws_key`).
+  * `memo` (*string, optional*): Location or host note (default: `Shuffle Automated Deployment`).
+  * `base_url` (*string, optional*): Custom controller URL.
+
+* **Sample Response:**
+```json
+{
+  "status": "success",
+  "token_id": "canary-9f82d1",
+  "token_type": "aws_key",
+  "credentials": {
+    "access_key_id": "AKIAIOSFODNN7EXAMPLE",
+    "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+  },
+  "memo": "Finance-DB-AppServer-01"
+}
+```
+
+---
+
+## Example Shuffle Workflow
+
+### Automated Decoy Breach Interdiction Playbook:
+```
+[Webhook / Schedule Trigger]
+            │
+            ▼
+[DECTRAX: get_recent_threats] ─── (Iterate over new CRITICAL threat events)
+            │
+            ▼
+[DECTRAX: block_ip] ──────────── (Line-rate drop on Palo Alto / Fortinet EDL in <1.5s)
+            │
+            ▼
+[Slack / Microsoft Teams] ────── (Notify SOC: "Decoy RDP breach from 198.51.100.42 quarantined")
+```
+
+---
+
+## Support & Enterprise Contact
+
+* **Publisher**: DECTRAX Security Engineering
+* **Website**: [https://dectrax.com](https://dectrax.com)
+* **Technical Inquiries**: `support@dectrax.com`
+* **License**: Apache License 2.0

dectrax/1.0.0/api.yaml

@@ -0,0 +1,113 @@
+app_version: 1.0.0
+name: dectrax
+description: Autonomous Cyber Deception, Honeytokens, and Line-Rate Firewall Interdiction for Shuffle SOAR
+contact_info:
+  name: DECTRAX Security Engineering
+  url: https://dectrax.com
+  email: support@dectrax.com
+tags:
+  - Deception
+  - Incident Response
+  - Threat Intelligence
+  - Firewall
+categories:
+  - Network
+  - Eradication
+  - Intelligence
+large_image: ""
+authentication:
+  required: true
+  parameters:
+    - name: apikey
+      description: DECTRAX API Bearer Token
+      example: "sec_tok_live_demo_98234"
+      required: true
+      schema:
+        type: string
+actions:
+  - name: block_ip
+    description: Automatically publishes an attacker IP into the DECTRAX External Dynamic List (EDL) feed for immediate sub-1.5s perimeter drop across Palo Alto, Fortinet, and Linux firewalls.
+    parameters:
+      - name: ip
+        description: Malicious attacker IPv4 address to quarantine
+        required: true
+        example: "198.51.100.42"
+        schema:
+          type: string
+      - name: reason
+        description: Incident justification or trigger identifier
+        required: false
+        example: "Shuffle SOAR Automated Interdiction"
+        default: "Shuffle SOAR Automated Interdiction"
+        schema:
+          type: string
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object
+  - name: get_blocked_ips
+    description: Fetches the current newline-delimited external dynamic list consumed by Linux nftables, Palo Alto Networks, and Fortinet firewalls.
+    parameters:
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object
+  - name: get_recent_threats
+    description: Retrieves high-fidelity honeypot breach events and attacker TTPs with deterministic 0.00% false positive accuracy.
+    parameters:
+      - name: limit
+        description: Maximum number of events to retrieve
+        required: false
+        example: 50
+        default: 50
+        schema:
+          type: integer
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object
+  - name: generate_honeytoken
+    description: Provisions on-demand canary credentials, decoy AWS access keys, or fake Kerberos SPNs to plant across production hosts.
+    parameters:
+      - name: token_type
+        description: Type of synthetic canary asset to generate (aws_key, database_creds, jwt_token, kerberos_spn)
+        required: false
+        example: "aws_key"
+        default: "aws_key"
+        schema:
+          type: string
+      - name: memo
+        description: Deployment location notes or host identifier
+        required: false
+        example: "Shuffle Automated Deployment"
+        default: "Shuffle Automated Deployment"
+        schema:
+          type: string
+      - name: base_url
+        description: Optional override for DECTRAX on-premise controller
+        required: false
+        example: "https://api.dectrax.com"
+        default: "https://api.dectrax.com"
+        schema:
+          type: string
+    returns:
+      schema:
+        type: object

dectrax/1.0.0/requirements.txt

@@ -0,0 +1 @@
+requests>=2.31.0