Merge pull request #1011 from stratosphereips/develop

v1.1.2

Author: AlyaGomaa

.github/ISSUE_TEMPLATE/bug_report.md

@@ -39,7 +39,6 @@ Master or Develop?
  - Python version [e.g. 3.10]
  - Are you running slips in docker or locally? [yes/no]
  - Docker version (if running slips in docker) [e.g. 20.10.22]
- - Slips docker image used (if running slips in docker) [e.g. macosm1-image, macosm1-P2P-image, ubuntu-image, dependency-image]
  - Commit hash: ( `git rev-parse --short HEAD` )
 
 **Additional context**

.github/workflows/CI-publishing-ubuntu-image.yml

@@ -1,4 +1,4 @@
-name: CI-production-publishing-p2p-image
+name: CI-production-publishing-slips-image
 
 on:
   push:
@@ -7,7 +7,7 @@ on:
     - '!develop'
 
 jobs:
-  publish_P2P_docker_image:
+  publish_slips_docker_image:
     # runs the tests in a docker(built by this job) on stop of a GH VM
     runs-on: ubuntu-20.04
     # 2 hours timeout
@@ -40,14 +40,14 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
-    - name: Build and push p2p image using dockerfile
-      id: docker_build_p2p_for_slips
+    - name: Build and push Slips image using dockerfile
+      id: docker_build_slips
       uses: docker/build-push-action@v6
       with:
         allow: network.host
         context: ./
-        file: ./docker/P2P-image/Dockerfile
+        file: ./docker/Dockerfile
         tags: |
-          stratosphereips/slips_p2p:latest
-          stratosphereips/slips_p2p:${{ env.SLIPS_VERSION }}
+          stratosphereips/slips:latest
+          stratosphereips/slips:${{ env.SLIPS_VERSION }}
         push: true

…ub/workflows/CI-publishing-p2p-image.yml .github/workflows/publish-slips-image.yml.github/workflows/CI-publishing-p2p-image.yml renamed to .github/workflows/publish-slips-image.yml .github/workflows/CI-publishing-p2p-image.yml renamed to .github/workflows/publish-slips-image.yml

@@ -55,6 +55,7 @@ jobs:
           - tests/test_trustdb.py
           - tests/test_cesnet.py
           - tests/test_output.py
+          - tests/test_riskiq.py
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/unit-tests.yml

@@ -134,7 +134,8 @@ logs/
 dump.rdb
 package-lock.json
 modules/blessed/node_modules/
-alerts.*
+alerts.log
+alerts.json
 errors.log
 nohup.out
 modules/threat_intelligence/remote_data_files/*

…flows/CI-publishing-update-code-docs.yml .github/workflows/update-code-docs.yml.github/workflows/CI-publishing-update-code-docs.yml renamed to .github/workflows/update-code-docs.yml .github/workflows/CI-publishing-update-code-docs.yml renamed to .github/workflows/update-code-docs.yml

@@ -1,4 +1,17 @@
-- 1.1.1 (September 4th, 2024)
+- 1.1.2 (September 30th, 2024)
+- Add a relation between related evidence in alerts.json
+- Better unit tests. Thanks to @Sekhar-Kumar-Dash
+- Discontinued MacOS m1 docker images, P2p images, and slips dependencies image.
+- Fix the problem of the progress bar stopping before analysis is done, causing Slips to freeze when analyzing large PCAPs.
+- Improve how Slips recognizes the current host IP.
+- Increase the speed of the Flowalerts module by changing how Slips checks for DNS servers.
+- Major code improvements.
+- Remove redundant keys from the Redis database.
+- Remove unused keys from the Redis database.
+- Use IDMEFv2 format in alerts.json instead of IDEA0.
+- Wait for modules to finish 1 week by default.
+
+1.1.1 (September 4th, 2024)
 - Better unit tests. thanks to @Sekhar-Kumar-Dash.
 - Fix Zeek warning caused by one of the loaded zeek scripts.
 - Fix Slips installation scripts at install/install.sh

.gitignore

@@ -1,5 +1,5 @@
 <h1 align="center">
-Slips v1.1.1
+Slips v1.1.2
 </h1>
 
 
@@ -160,14 +160,7 @@ Slips can be run on different platforms, the easiest and most recommended way if
 
 * [Docker](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#slips-in-docker)
   * Dockerhub (recommended)
-    * On a linux host
-      * [Without P2P support](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#for-linux)
-      * [With P2P support](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#for-p2p-support-on-linux)
-    * On MacOS M1 host
-      * [Without P2P support](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#for-macos-m1)
-    * On MacOS Intel processor
-      * [Without P2P support](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#for-macos-intel-processors)
-      * [With P2P support](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#for-p2p-support-on-macos-intel)
+    * [Linux, MacOS and windows hosts](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#Running-Slips-from-DockerHub)
   * [Docker-compose](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#running-slips-using-docker-compose)
   * [Dockerfile](https://stratospherelinuxips.readthedocs.io/en/develop/installation.html#building-slips-from-the-dockerfile)
 * Native
@@ -212,7 +205,7 @@ Slips can be run on different platforms, the easiest and most recommended way if
 
 
 # Configuration
-Slips has a [config/slips.conf](https://github.com/stratosphereips/StratosphereLinuxIPS/blob/develop/config/slips.conf) that contains user configurations for different modules and general execution.
+Slips has a [config/slips.yaml](https://github.com/stratosphereips/StratosphereLinuxIPS/blob/develop/config/slips.yaml) that contains user configurations for different modules and general execution.
 
 * You can change the timewindow width by modifying the ```time_window_width``` parameter
 * You can change the analysis direction to ```all```  if you want to see the attacks from and to your computer

CHANGELOG.md

@@ -1 +1 @@
-1.1.1
+1.1.2

README.md

@@ -125,7 +125,9 @@ parameters:
    keep_rotated_files_for : 1 day
 
    # how many minutes to wait for all modules to finish before killing them
-   wait_for_modules_to_finish : 15 mins
+   #wait_for_modules_to_finish : 15 mins
+   # 1 week
+   wait_for_modules_to_finish : 10080 mins
 
    # flows are labeled to normal/malicious and added to the sqlite db in the output dir by default
    export_labeled_flows : False
@@ -170,9 +172,9 @@ detection:
 modules:
    # List of modules to ignore. By default we always ignore the template! do not remove it from the list
    # Names of other modules that you can disable (they all should be lowercase with no special characters):
-   # ensembling, threatintelligence, blocking,
+   # threatintelligence, blocking,
    # networkdiscovery, timeline, virustotal, rnnccdetection, flowmldetection, updatemanager
-   disable: "[template , ensembling]"
+   disable: "[template]"
 
    # For each line in timeline file there is a timestamp.
    # By default the timestamp is seconds in unix time. However