Skip to content

Issues: stratosphereips/StratosphereLinuxIPS

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

275 Open 344 Closed
275 Open 344 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

the % of flows read don't show in the pcaps, but after the input process is done, we know the total floas to be processed by slips, we can then add the flows % to the stats using that number.
#1113 opened Dec 11, 2024 by AlyaGomaa
query missing from "blacklisted dns answer" evidence
#1111 opened Dec 10, 2024 by AlyaGomaa
RNN CC Detection module has 25+ threads opened when analysing a large pcap. check why
#1108 opened Dec 9, 2024 by AlyaGomaa
GeoLite2-ASN.mmdb and GeoLite2-Country.mmdb are included in slips repo, download them on startup instead. They’re 11MB
#1103 opened Dec 3, 2024 by AlyaGomaa
Some threat intelligence lists have false positives. Slips should filter the easy ones. Bug Difficulty: Beginners Stuff that you can do with skills for starters Help wanted
#1094 opened Dec 1, 2024 by eldraco
@AlyaGomaa @AbhiramMasna
2
The 'Detected Long Connection' detection wrongly considers broadcast addresses. Bug Difficulty: Beginners Stuff that you can do with skills for starters Help wanted
#1093 opened Dec 1, 2024 by eldraco
@AlyaGomaa
CI: Publish the 2 docker images in parallel on push to master
#1091 opened Nov 29, 2024 by AlyaGomaa
@AlyaGomaa
Be nice to have this ported to FreeBSD so it can work with Opnsense
#1089 opened Nov 29, 2024 by lpingree
Profiles that generate an alert while analysing PCAPs should be marked in red, not just timewindows Difficulty: Beginners Stuff that you can do with skills for starters Web Interface
#1083 opened Nov 27, 2024 by AlyaGomaa
@AbhiramMasna
5
running_slips_infto.txt should have json lines instead
#1080 opened Nov 25, 2024 by AlyaGomaa
move the tests at webinterface/tests/redis_tests.py to the tests/ dir and run them using CI
#1076 opened Nov 21, 2024 by AlyaGomaa
Use more descriptive db key names
#1072 opened Nov 19, 2024 by AlyaGomaa
Check why some evidence in alerts.log had and extra \n at the end.
#1039 opened Oct 22, 2024 by AlyaGomaa
Rename this key 'DstPortsClientTCPNot Established' used in the horizontal portscan to something that state that these are “resolved_ips”
#1030 opened Oct 9, 2024 by AlyaGomaa
Check if we have issues, like illegal instruction running ml modules, we can disable them automatically
#1025 opened Oct 8, 2024 by AlyaGomaa
Add a script to start the local and global p2p from inside docker
#1004 opened Sep 25, 2024 by AlyaGomaa
in the check_connection_without_dns_resolution detection, why wait for the dns connection to appear in dns.log if we already have it in conn.log with the proto "dns"?
#1003 opened Sep 24, 2024 by AlyaGomaa
re-do ensembling module
#1000 opened Sep 24, 2024 by AlyaGomaa
1 of 2 tasks
1
Slips is not listening forever for whitelist changes, it's only listening until profiler.py is dont receiving flows. after that, profiler stops and slips doesnt see whitelist changes anymore
#997 opened Sep 23, 2024 by AlyaGomaa
Add an integration test for test18-malicious-ctu-sme-11-win
#995 opened Sep 20, 2024 by AlyaGomaa
Slips pcap analysis needs hours for bigger test files
#986 opened Sep 13, 2024 by maldwg
2
Some unit tests re-write redis.conf. This shouldn't be happening
#975 opened Aug 30, 2024 by AlyaGomaa
Disable modules if HW support is missing
#967 opened Aug 28, 2024 by be-a-panther
@AlyaGomaa
1
Split ports_used_by_specific_orgs.csv into 2 files, one with the IPs , one without, and document that both files are used differently
#963 opened Aug 27, 2024 by AlyaGomaa
Delete the known ports from port_belongs_to_org.csv (the ones that we already have in services.csv)
#962 opened Aug 27, 2024 by AlyaGomaa
ProTip! Mix and match filters to narrow down what you’re looking for.