Merge pull request #1585 from stratosphereips/develop

Slips v1.1.13

Author: AlyaGomaa

.github/workflows/install-slips-dependencies.yml

@@ -25,7 +25,7 @@ jobs:
     outputs:
       dependencies_installed: ${{ steps.mark_installed.outputs.installed }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ github.ref }}
         fetch-depth: ''

.github/workflows/integration-tests.yml

@@ -35,7 +35,7 @@ jobs:
           - test_iris.py
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ github.ref }}
         fetch-depth: ''

.github/workflows/publish-slips-images.yml

@@ -60,7 +60,7 @@ jobs:
 
       # clone slips and checkout branch
       # By default it checks out only one commit
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: 'master'
           # Fetch all history for all tags and branches

.github/workflows/unit-tests.yml

@@ -90,7 +90,7 @@ jobs:
           - test_fides_bridge.py
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ github.ref }}
         fetch-depth: 0

.github/workflows/update-code-docs.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: 'code-docs-branch'
           fetch-depth: 0 # otherwise, you will fail to push refs to the dest repo

CHANGELOG.md

@@ -1,3 +1,10 @@
+1.1.13 (Sep 1st, 2025)
+- Add detection for DNS answers of malicious DNS queries.
+- Support using Zeek v8.0.0.
+- Speedup of evidence processing in Slips.
+- Update Python dependencies.
+
+
 1.1.12 (July 31st, 2025)
 - Better filtering of attacks in the ARP poisoner filter and excluded poisoning the gateway.
 - Cache ARP scan results to avoid flooding the network with ARP packets.

README.md

@@ -1,5 +1,5 @@
 <h1 align="center">
-Slips v1.1.12
+Slips v1.1.13
 </h1>
 
 

VERSION

@@ -1 +1 @@
-1.1.12
+1.1.13

docs/detection_modules.md

@@ -394,6 +394,9 @@ For example, if the domain in the traffic is _here.testing.com_,
 Slips first checks if the exact domain _here.testing.com_ is in any blacklist,
 and if there is no match, it checks if the domain _testing.com_ is in any blacklists too.
 
+Slips also sets evidence about DNS answers of blacklisted domains. If test.com is blacklisted, and test.com resolves to 1.2.3.4, slips sets
+an evidence when it encouters the DNS answer with 1.2.3.4.
+
 ### Matching of JA3 Hashes
 
 Every time Slips encounters an TLS flow,

docs/features.md

@@ -640,7 +640,8 @@ File hashes and URLs aren't supported.
 
 Slips gets every IP it can find in the network and tries to see if it is in any blacklist.
 
-If a match is found, it generates an evidence, if no exact match is found, it searches the Blacklisted ranges taken from different TI feeds
+If a match is found, it generates an evidence, if no exact match is found,
+it searches the Blacklisted ranges taken from different TI feeds
 
 
 #### Matching of Domains