SATARK security analytics

SATARK

Scalable Automated Technology for Analysis and Ranking of Known Threats

An open-source security analytics framework for building explainable detection pipelines across insider threats, malware, phishing, cloud, identity, email and web security.

Read the documentation View on GitHub Explore the architecture

Architecture

Plugin-first analytics: normalize telemetry into Events, then run detect → score → explain. Supporting layers (rules, knowledge, graph, AI) sit beside the critical path. Open the architecture page for invariants and docs links. 

flowchart LR
  T["Telemetry"] --> P["Plugins"]
  P --> E["Events"]
  E --> ENG["AnalysisEngine"]
  ENG --> PIPE["detect → score → explain"]
  PIPE --> F["Findings"]
  R["Rules"] -.-> ENG
  K["Knowledge"] -.-> PIPE
  AI["AI optional"] -.-> F

  classDef neon fill:#121214,stroke:#ed1c24,stroke-width:2px,color:#f4f4f5
  classDef neonAmber fill:#121214,stroke:#e0b35a,stroke-width:2px,color:#f4f4f5
  classDef neonOut fill:#1a0a0b,stroke:#ff4d54,stroke-width:2.5px,color:#fff5f5

  class T,P,E,ENG,PIPE neon
  class F neonOut
  class R,K,AI neonAmber

  linkStyle default stroke:#ff4d54,stroke-width:2px
Compact view of the SATARK pipeline. Neon red edges mark the main flow; amber nodes are supporting modules.

Insider plugin analyzing sample USB/file telemetry into explainable findings. More detail on the architecture page.

SATARK CLI listing built-in plugins and starting insider analysis on sample CSV data
Built-in plugins and the insider analyze command.
SATARK CLI findings table showing anomalous USB and file activity for alice with explainable risk scores
Elevated USB and file-activity findings with score explanations.

Project evolution

SATARK is being rebuilt in public as an open-source framework. See the full history timeline for dates, publications, and PhD milestones.

Research origin

Introduced in 2011 as Project Satark for web security services, then pivoted in 2013 toward insider threat detection.

Academic validation

From 2016 through 2022: Springer-published Threat-Rank research, deep-learning work at SAM’18, and a defended PhD on behavioral insider-threat prediction.

Open-source framework

SATARK is now being rebuilt as an open-source security analytics framework with a plugin-first architecture and transparent scoring.

What SATARK focuses on

  • Normalizing diverse security telemetry into a common event model
  • Building reusable detection plugins across security domains
  • Producing explainable risk scores with evidence and confidence
  • Keeping AI optional — detections remain reproducible without an LLM

Official home

satark.org is the canonical website for the SATARK open-source project. Documentation lives at satark.org/docs/.

Current status: early open-source rebuild (alpha). APIs and packaging may change as the framework matures.