Skip to content

v1.1.2 #1011

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
AlyaGomaa merged 270 commits into from
Sep 30, 2024
Merged

v1.1.2 #1011

AlyaGomaa merged 270 commits into from
Sep 30, 2024

Conversation

@AlyaGomaa
Copy link
Collaborator

@AlyaGomaa AlyaGomaa commented Sep 30, 2024

  • Add a relation between related evidence in alerts.json
  • Better unit tests. Thanks to @Sekhar-Kumar-Dash
  • Discontinued MacOS m1 docker images, P2p images, and slips dependencies image.
  • Fix the problem of the progress bar stopping before analysis is done, causing Slips to freeze when analyzing large PCAPs.
  • Improve how Slips recognizes the current host IP.
  • Increase the speed of the Flowalerts module by changing how Slips checks for DNS servers.
  • Major code improvements.
  • Remove redundant keys from the Redis database.
  • Remove unused keys from the Redis database.
  • Use IDMEFv2 format in alerts.json instead of IDEA0.
  • Wait for modules to finish 1 week by default.

AlyaGomaa and others added 30 commits August 14, 2024 23:09
@AlyaGomaa
Merge remote-tracking branch 'origin/develop' into fork/Sekhar-Kumar-…
3390bfb 
…Dash/patch-44

# Conflicts:
#	tests/module_factory.py
@Sekhar-Kumar-Dash
Updated symbols_handler.py
a19458d
@Sekhar-Kumar-Dash
Updated test_symbols_handler.py
3da9944
@AlyaGomaa
Add IDMEFv2 to dockers and install.sh
f2ae77e
@AlyaGomaa
move get_slips_version() to slips_utils.py
c9914ad
@AlyaGomaa
idmefv2.py: Add an idmef handler to convert slip evidence to imefv2
bfd5e54
@AlyaGomaa
Remove idea format conn_count, category, and source target tags from …
b238029 
…slips evidence
@AlyaGomaa
evidencehandler.py: use IDMEFv2 instead of IDEA
d3e7d8f
@AlyaGomaa
update unit tests
1fdcc25
@AlyaGomaa
use lowercase function names
83a337a
@AlyaGomaa
move all redis hash names from ioc_handler to constants.py
626f01d
@AlyaGomaa
ioc_handler.py: refactor and group similar functions together
41b1990
@AlyaGomaa
database.py: move IPsInfo key name to constants.py
add31dd
@AlyaGomaa
remove unused MaliciousIPs key from redis db
23b340c
@AlyaGomaa
remove unused MaliciousDomains key from redis db
a936f2e
@AlyaGomaa
databse: rename URLsInfo to virustotal_cached_url_info & refactor to …
e86811c 
…avoid confusion
@AlyaGomaa
evidencehandler.py: handle adding the missing idmefv2 fields in the N…
a766077 
…ote field
@AlyaGomaa
idmefv2: add a RelID to tie related evidence together
2742953
@AlyaGomaa
Use the RelID field in all related evidence
bcb7e26
@AlyaGomaa
Handle setting all alert details in rdb and sqlite instead of evidenc…
6f9f56f 
…ehandler
@AlyaGomaa
evidencehandler: refactor and better document how alerts are dealt with
af6c058
@AlyaGomaa
Add a dataclass for Alert to unify alerts fields
5aecceb
@AlyaGomaa
Move the function converting objects to dicts to slips_files instead …
a09b704 
…of evidence.py
@AlyaGomaa
alerts.py: Add accumulated threat level and last_flow_datetime fields…
0887f89 
… to each alert
@AlyaGomaa
Use the new alert format in the database
80af6be
@AlyaGomaa
Use the new alert format in the evidencehandler.py
d7aaa21
@AlyaGomaa
Remove the start and end time from Alert dataclass and add it to the …
0e25f76 
…TimeWinow dataclass instead
@AlyaGomaa
idmef: Add function to convert and Alert dataclass to an IDMEFv2 msg
a3e0363
@AlyaGomaa
evidencehandler.py: handle logging idmef alerts to alerts.json
25a5ed6
@AlyaGomaa
Add a printer class to act as a proxy between all modules and the out…
3aa4454 
…put process [the goal here is to remove duplicate print functions everywhere]
@AlyaGomaa
Merge pull request #858 from Sekhar-Kumar-Dash/patch-44
8fc212b 
add unit tests for RiskIQ module
@AlyaGomaa
Merge branch 'develop' into patch-48
cab13f7
@AlyaGomaa
Merge pull request #904 from Sekhar-Kumar-Dash/patch-48
7c3630a 
add unit tests for symbols handler
@AlyaGomaa
fix stopping pbar as soon as the termination event is set instead of …
34e2af3 
…when pbar reaches 100%
@AlyaGomaa
profiler: remove the stopping logic from check_for_stop_msg() to shut…
0c99657 
…down_gracefully()
@AlyaGomaa
zeek.py: fix redefining type_ field of Notice objects
6e57eab
@AlyaGomaa
update progress bar unit tests
afc2d16
@AlyaGomaa
threat_intelligence.py: treat the return value of is_blacklisted_doma…
2058757 
…in as a dict not a serialized dict
@AlyaGomaa
update profiler unit tests
b458c07
@AlyaGomaa
profiler: add error handling of invalid flows
f7f1f5e
@AlyaGomaa
ioc_handler: fix problem setting evidence blacklisted domain
96339c3
@AlyaGomaa
update threat intelligence unit tests
0e63e89
@AlyaGomaa
profiler: run progress bar normally when -t is given
efc595e
@AlyaGomaa
profiler: update unit tests
5369e58
@AlyaGomaa
flowalerts: dont check dns servers by making a dns query to each ip w…
6b6ab9c 
…hen checking for connection without dns
@AlyaGomaa
delete unused ensembling module
07864a1
@AlyaGomaa
test_conn.py: update test_should_ignore_conn_without_dns()
17a9ea9
@AlyaGomaa
Merge pull request #998 from stratosphereips/alya/fix-pbar
ff55b3b 
Fix problem with slips freezing in large PCAPs
@AlyaGomaa
Merge pull request #1005 from stratosphereips/alya/fix-checking-for-d…
34be605 
…ns-servers

remove the is_dns_server() function from flowalerts
@AlyaGomaa
Merge pull request #1006 from stratosphereips/alya/delete-ensembling-…
12ab08a 
…module

delete ensembling module
@AlyaGomaa
remove all docker images except the ubuntu image with p2p support, an…
9285d4c 
…d update the docs
@AlyaGomaa
update CI to publish the p2p docker image as "stratosphereips/slips"
11e5158
@AlyaGomaa
update CHANGELOG.md
379afb0
@AlyaGomaa
fix printing daemon errors
02b2bce
@AlyaGomaa
bump slips version to 1.1.2
17232b0
@AlyaGomaa
suppress runtime errors when trying to flush a redis server that's al…
55123f2 
…ready closed
@AlyaGomaa
fix progress bar printing duplicate bars on ctrl+c
13eaaaf
@AlyaGomaa
update slips gif
67d99e5
@AlyaGomaa
update progress bar unit tests
ad592b5
@AlyaGomaa AlyaGomaa merged commit 9a104ca into master Sep 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

Slips
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@AlyaGomaa @Sekhar-Kumar-Dash