v1.1.2 #1011

AlyaGomaa · 2024-09-30T13:33:53Z

Add a relation between related evidence in alerts.json
Better unit tests. Thanks to @Sekhar-Kumar-Dash
Discontinued MacOS m1 docker images, P2p images, and slips dependencies image.
Fix the problem of the progress bar stopping before analysis is done, causing Slips to freeze when analyzing large PCAPs.
Improve how Slips recognizes the current host IP.
Increase the speed of the Flowalerts module by changing how Slips checks for DNS servers.
Major code improvements.
Remove redundant keys from the Redis database.
Remove unused keys from the Redis database.
Use IDMEFv2 format in alerts.json instead of IDEA0.
Wait for modules to finish 1 week by default.

…Dash/patch-44 # Conflicts: # tests/module_factory.py

…slips evidence

…avoid confusion

…ote field

…ehandler

…of evidence.py

… to each alert

…TimeWinow dataclass instead

…put process [the goal here is to remove duplicate print functions everywhere]

add unit tests for RiskIQ module

add unit tests for symbols handler

…when pbar reaches 100%

…down_gracefully()

…in as a dict not a serialized dict

…hen checking for connection without dns

Fix problem with slips freezing in large PCAPs

…ns-servers remove the is_dns_server() function from flowalerts

…module delete ensembling module

…d update the docs

…ready closed

AlyaGomaa and others added 30 commits August 14, 2024 23:09

Merge remote-tracking branch 'origin/develop' into fork/Sekhar-Kumar-…

3390bfb

…Dash/patch-44 # Conflicts: # tests/module_factory.py

Updated symbols_handler.py

a19458d

Updated test_symbols_handler.py

3da9944

Add IDMEFv2 to dockers and install.sh

f2ae77e

move get_slips_version() to slips_utils.py

c9914ad

idmefv2.py: Add an idmef handler to convert slip evidence to imefv2

bfd5e54

Remove idea format conn_count, category, and source target tags from …

b238029

…slips evidence

evidencehandler.py: use IDMEFv2 instead of IDEA

d3e7d8f

update unit tests

1fdcc25

use lowercase function names

83a337a

move all redis hash names from ioc_handler to constants.py

626f01d

ioc_handler.py: refactor and group similar functions together

41b1990

database.py: move IPsInfo key name to constants.py

add31dd

remove unused MaliciousIPs key from redis db

23b340c

remove unused MaliciousDomains key from redis db

a936f2e

databse: rename URLsInfo to virustotal_cached_url_info & refactor to …

e86811c

…avoid confusion

evidencehandler.py: handle adding the missing idmefv2 fields in the N…

a766077

…ote field

idmefv2: add a RelID to tie related evidence together

2742953

Use the RelID field in all related evidence

bcb7e26

Handle setting all alert details in rdb and sqlite instead of evidenc…

6f9f56f

…ehandler

evidencehandler: refactor and better document how alerts are dealt with

af6c058

Add a dataclass for Alert to unify alerts fields

5aecceb

Move the function converting objects to dicts to slips_files instead …

a09b704

…of evidence.py

alerts.py: Add accumulated threat level and last_flow_datetime fields…

0887f89

… to each alert

Use the new alert format in the database

80af6be

Use the new alert format in the evidencehandler.py

d7aaa21

Remove the start and end time from Alert dataclass and add it to the …

0e25f76

…TimeWinow dataclass instead

idmef: Add function to convert and Alert dataclass to an IDMEFv2 msg

a3e0363

evidencehandler.py: handle logging idmef alerts to alerts.json

25a5ed6

Add a printer class to act as a proxy between all modules and the out…

3aa4454

…put process [the goal here is to remove duplicate print functions everywhere]

AlyaGomaa added 29 commits September 23, 2024 14:39

Merge pull request #858 from Sekhar-Kumar-Dash/patch-44

8fc212b

add unit tests for RiskIQ module

Merge branch 'develop' into patch-48

cab13f7

Merge pull request #904 from Sekhar-Kumar-Dash/patch-48

7c3630a

add unit tests for symbols handler

fix stopping pbar as soon as the termination event is set instead of …

34e2af3

…when pbar reaches 100%

profiler: remove the stopping logic from check_for_stop_msg() to shut…

0c99657

…down_gracefully()

zeek.py: fix redefining type_ field of Notice objects

6e57eab

update progress bar unit tests

afc2d16

threat_intelligence.py: treat the return value of is_blacklisted_doma…

2058757

…in as a dict not a serialized dict

update profiler unit tests

b458c07

profiler: add error handling of invalid flows

f7f1f5e

ioc_handler: fix problem setting evidence blacklisted domain

96339c3

update threat intelligence unit tests

0e63e89

profiler: run progress bar normally when -t is given

efc595e

profiler: update unit tests

5369e58

flowalerts: dont check dns servers by making a dns query to each ip w…

6b6ab9c

…hen checking for connection without dns

delete unused ensembling module

07864a1

test_conn.py: update test_should_ignore_conn_without_dns()

17a9ea9

Merge pull request #998 from stratosphereips/alya/fix-pbar

ff55b3b

Fix problem with slips freezing in large PCAPs

Merge pull request #1005 from stratosphereips/alya/fix-checking-for-d…

34be605

…ns-servers remove the is_dns_server() function from flowalerts

Merge pull request #1006 from stratosphereips/alya/delete-ensembling-…

12ab08a

…module delete ensembling module

remove all docker images except the ubuntu image with p2p support, an…

9285d4c

…d update the docs

update CI to publish the p2p docker image as "stratosphereips/slips"

11e5158

update CHANGELOG.md

379afb0

fix printing daemon errors

02b2bce

bump slips version to 1.1.2

17232b0

suppress runtime errors when trying to flush a redis server that's al…

55123f2

…ready closed

fix progress bar printing duplicate bars on ctrl+c

13eaaaf

update slips gif

67d99e5

update progress bar unit tests

ad592b5

AlyaGomaa merged commit 9a104ca into master Sep 30, 2024
45 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v1.1.2 #1011

v1.1.2 #1011

AlyaGomaa commented Sep 30, 2024

v1.1.2 #1011

v1.1.2 #1011

Conversation

AlyaGomaa commented Sep 30, 2024