Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
72 commits
Select commit Hold shift + click to select a range
106931b
Add a default medallion server configuration
eldraco Nov 8, 2025
30c00eb
Update export module to export to STIX v2
eldraco Nov 8, 2025
815dd17
Default creds for exporting must be changed
eldraco Nov 8, 2025
ad5d64b
Update the medallion config to load basic API from a second configura…
eldraco Nov 8, 2025
01d1aaf
Update the conf of data to include the endpoints
eldraco Nov 8, 2025
d833bb6
Update the requirements for taxii
eldraco Nov 8, 2025
eaf2cae
Add the docs for visualization
eldraco Nov 8, 2025
25ce4de
Update the docs for export
eldraco Nov 8, 2025
1ea54a8
Update the libraries excluded
eldraco Nov 8, 2025
e24d1e6
Fix sendind the data to a taxii server correctly
eldraco Nov 8, 2025
becd63b
Add the new stratosphereweb as a submodule
eldraco Nov 9, 2025
533bab4
Fix the config to export correctly to STIX when enabled
eldraco Nov 9, 2025
eeca0cb
Add the web visualization of alerts doc
eldraco Nov 9, 2025
097aba0
Improve installation instructions
eldraco Nov 9, 2025
ecd63c9
Refactor ExportingAlerts module to improve export target checks and s…
eldraco Nov 9, 2025
b2f844b
Refactor StixExporter to enhance evidence handling and streamline STI…
eldraco Nov 9, 2025
6ce576f
Update exporting_alerts configuration for TAXII 2 endpoints and clari…
eldraco Nov 9, 2025
b6a555f
Remove medallion configuration file and remove default data file
eldraco Nov 9, 2025
3cacbef
Add documentation for Stratosphere Web Visualization and Medallion TA…
eldraco Nov 9, 2025
3f93e98
Remove medallion configuration file to streamline setup process
eldraco Nov 9, 2025
340f123
Re-register StratosphereWeb submodule with new SlipsWeb URL
eldraco Nov 9, 2025
a493659
Rename submodule folder to SlipsWeb
eldraco Nov 9, 2025
f8d08e6
Update TAXII configuration instructions to clarify HTTPS support and …
eldraco Nov 9, 2025
44d2f43
Update SlipsWeb submodule to latest commit
eldraco Nov 9, 2025
ecc61c0
Fix documentation: Update section headers and clarify TAXII server in…
eldraco Nov 9, 2025
18942bc
Refactor _build_custom_properties to include date_added parameter and…
eldraco Nov 9, 2025
4433370
Update the SlipsWeb commit of the submodule
eldraco Nov 9, 2025
e837e47
Add logging for evidence reception in ExportingAlerts module
eldraco Nov 9, 2025
0ad571e
Enhance STIX export functionality: ensure bundle file creation, track…
eldraco Nov 9, 2025
7938a33
Enhance evidence export functionality: add logging for evidence expor…
eldraco Nov 9, 2025
bc41814
Increase log verbosity for evidence export and streaming operations
eldraco Nov 9, 2025
f88a8a5
Increase log verbosity for received evidence in ExportingAlerts module
eldraco Nov 10, 2025
0d13315
Increase log verbosity for STIX export operations
eldraco Nov 10, 2025
3d86ad9
Add a default medallion server configuration
eldraco Nov 8, 2025
166d11f
Update export module to export to STIX v2
eldraco Nov 8, 2025
a3d0feb
Default creds for exporting must be changed
eldraco Nov 8, 2025
cce2f62
Update the medallion config to load basic API from a second configura…
eldraco Nov 8, 2025
8f85ae0
Update the conf of data to include the endpoints
eldraco Nov 8, 2025
b184d8a
Update the requirements for taxii
eldraco Nov 8, 2025
fe515b6
Add the docs for visualization
eldraco Nov 8, 2025
b67a329
Update the docs for export
eldraco Nov 8, 2025
143d8b4
Update the libraries excluded
eldraco Nov 8, 2025
5a49c48
Fix sendind the data to a taxii server correctly
eldraco Nov 8, 2025
6b1f0ee
Add the new stratosphereweb as a submodule
eldraco Nov 9, 2025
5b678b2
Fix the config to export correctly to STIX when enabled
eldraco Nov 9, 2025
3bd90fb
Add the web visualization of alerts doc
eldraco Nov 9, 2025
c9a3afa
Improve installation instructions
eldraco Nov 9, 2025
ab01ffa
Refactor ExportingAlerts module to improve export target checks and s…
eldraco Nov 9, 2025
cfed524
Refactor StixExporter to enhance evidence handling and streamline STI…
eldraco Nov 9, 2025
cb03fa0
Update exporting_alerts configuration for TAXII 2 endpoints and clari…
eldraco Nov 9, 2025
6f4e981
Remove medallion configuration file and remove default data file
eldraco Nov 9, 2025
80be52b
Add documentation for Stratosphere Web Visualization and Medallion TA…
eldraco Nov 9, 2025
3ca1f2d
Remove medallion configuration file to streamline setup process
eldraco Nov 9, 2025
b9f5e75
Re-register StratosphereWeb submodule with new SlipsWeb URL
eldraco Nov 9, 2025
7854637
Rename submodule folder to SlipsWeb
eldraco Nov 9, 2025
f1e18fe
Update TAXII configuration instructions to clarify HTTPS support and …
eldraco Nov 9, 2025
e85e248
Update SlipsWeb submodule to latest commit
eldraco Nov 9, 2025
9677279
Fix documentation: Update section headers and clarify TAXII server in…
eldraco Nov 9, 2025
1a0cb17
Refactor _build_custom_properties to include date_added parameter and…
eldraco Nov 9, 2025
350bcfc
Update the SlipsWeb commit of the submodule
eldraco Nov 9, 2025
94d1b84
Add logging for evidence reception in ExportingAlerts module
eldraco Nov 9, 2025
03e3b00
Enhance STIX export functionality: ensure bundle file creation, track…
eldraco Nov 9, 2025
7d8b0f3
Enhance evidence export functionality: add logging for evidence expor…
eldraco Nov 9, 2025
38781be
Increase log verbosity for evidence export and streaming operations
eldraco Nov 9, 2025
072ec7b
Increase log verbosity for received evidence in ExportingAlerts module
eldraco Nov 10, 2025
0ede263
Increase log verbosity for STIX export operations
eldraco Nov 10, 2025
c0dd4df
Merge remote-tracking branch 'origin/sebas-alert-local-visualizer' in…
AlyaGomaa Nov 12, 2025
ac14de2
.gitmodules: store SlipsWeb submodule in SlipsWeb/, not StratosphereWeb
AlyaGomaa Nov 12, 2025
f0c6803
Fix zeek v8.0 in slips requirements, install.sh, workflows, etc. for …
AlyaGomaa Nov 12, 2025
170ea4d
use --fix-missing when installing zeek
AlyaGomaa Nov 12, 2025
ccdcbed
CI: use wget if apt fails to download zeek
AlyaGomaa Nov 12, 2025
2e179b5
CI: reset to CI from origin/develop
AlyaGomaa Nov 12, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .gitmodules
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,7 @@
path = feel_project
url = https://github.com/stratosphereips/feel_project
branch = main

[submodule "SlipsWeb"]
path = SlipsWeb
url = https://github.com/stratosphereips/SlipsWeb.git
1 change: 1 addition & 0 deletions SlipsWeb
Submodule SlipsWeb added at 131238
19 changes: 6 additions & 13 deletions config/slips.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -347,7 +347,7 @@ exporting_alerts:

# Configuer all the methods Slips will export data with
# Available options are slack or stix
# export_to : [stix]
# export_to : [stix] (And a TAXII server)
# export_to : [slack]
export_to: []

Expand All @@ -373,12 +373,11 @@ exporting_alerts:
# For Stix, if Slips should use TLS
use_https: false

# TAXII
discovery_path: /services/discovery-a
inbox_path: /services/inbox-a
# TAXII 2 discovery endpoint (relative path or full URL)
discovery_path: /taxii2/

# Collection on the server you want to push stix data to
collection_name: collection-a
# Collection (ID or title) on the server you want to push STIX data to
collection_name: Alerts

# This value is only used when Slips is running non-stop (e.g with -i )
# push_delay is the time to wait before pushing STIX data to server
Expand All @@ -390,13 +389,7 @@ exporting_alerts:

# TAXII server credentials
taxii_username: admin
taxii_password: admin

# URL used to obtain JWT token. set this to '' if you don't want to use it
# is required for JWT based authentication.
# (JWT based authentication is Optional)
# It's usually /management/auth
jwt_auth_path: /management/auth
taxii_password: changeme_before_installing_a_medallion_server

#############################
CESNET:
Expand Down
2 changes: 1 addition & 1 deletion docker/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ RUN apt update && apt install -y --no-install-recommends \
&& curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key | gpg --dearmor | tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null \
&& apt update \
&& apt install -y --no-install-recommends --fix-missing \
zeek \
zeek-8.0 \
npm \
&& ln -s /opt/zeek/bin/zeek /usr/local/bin/bro \
&& apt clean \
Expand Down
2 changes: 1 addition & 1 deletion docker/light/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ RUN set -eux; \
| tee /etc/apt/sources.list.d/security:zeek.list \
&& curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key \
| gpg --dearmor | tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null \
&& apt-get update && apt-get install -y --no-install-recommends --fix-missing zeek \
&& apt-get update && apt-get install -y --no-install-recommends --fix-missing zeek-8.0 \
&& ln -s /opt/zeek/bin/zeek /usr/local/bin/bro \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
Expand Down
1 change: 0 additions & 1 deletion docker/light/excluded_libs.txt
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ scikit_learn
slackclient
matplotlib
stix2
cabby
pandas
setuptools
numpy
Expand Down
44 changes: 21 additions & 23 deletions docs/exporting.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,46 +40,44 @@ You can do this by going to the channel, then clicking on the channel's name. Th

## STIX

If you want to export alerts to your TAXII server using STIX format, change ```export_to``` variable to export to STIX, and Slips will automatically generate a
```STIX_data.json``` containing all alerts it detects.
If you want to export alerts to your TAXII 2 server using STIX 2.1 format,
set ```export_to``` to ```stix``` and Slips will automatically generate a
```STIX_data.json``` bundle containing the indicators it detects and push it to
your collection.


[ExportingAlerts]
export_to = [stix]


You can add your TAXII server details in the following variables:
Configure the TAXII client by editing the following variables:

```TAXII_server```: link to your TAXII server
```TAXII_server```: host name or IP address of the TAXII server.

```port```: port to be used
```port```: TCP port (optional, defaults to 80/443).

```use_https```: use https or not.
```use_https```: set to true to connect over HTTPS (be careful that the default TAXII server in SlipsWeb, Medallion, do not support HTTPS yet)

```discovery_path``` and ```inbox_path``` should contain URIs not full urls. For example:
```discovery_path```: TAXII discovery endpoint path or full URL
(for example ```/taxii2/```).

```python
discovery_path = /services/discovery-a
inbox_path = /services/inbox-a
```

```collection_name```: the collection on the server you want to push your STIX data to.

```push_delay```: the time to wait before pushing STIX data to server (in seconds).
It is used when slips is running non-stop (e.g with -i )
```collection_name```: ID or title of the TAXII collection that should receive your indicators. Be default `Alerts`.

```taxii_username```: TAXII server user credentials
```push_delay```: time between automatic pushes (in seconds) when Slips is
running continuously.

```taxii_password```: TAXII server user password
```taxii_username``` / ```taxii_password```: credentials used for HTTP Basic authentication.

```jwt_auth_path```: auth path if JWT based authentication is used. It's usually /management/auth. this is what we
use to get a token.
**Change the default config password of the TAXII servers you are going to export to in ```config/medallion_config.yaml```**


if your TAXII server is a remote server, you can set the ```port``` to 443 or 80.
Slips stores the generated bundle for each run in the output directory of that
execution (for example `output/<run_id>/STIX_data.json`), so you can inspect the
exact STIX objects that were pushed.

If running on a file, Slips will export to server after analysis is done.
If running on an interface, Slips will export to server every push_delay seconds. by default it's 1h.
If running on a file, Slips will export once before shutdown.
If running on an interface, Slips will export to the server every
```push_delay``` seconds (default 1 hour).

## JSON format

Expand Down
1 change: 1 addition & 0 deletions docs/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -63,3 +63,4 @@ This documentation gives an overview how Slips works, how to use it and how to h
contributing
code_documentation
related_repos
visualisation
8 changes: 4 additions & 4 deletions docs/installation.md
Original file line number Diff line number Diff line change
Expand Up @@ -203,26 +203,25 @@ You can read more about it [here](https://stratospherelinuxips.readthedocs.io/en

## Installing Slips natively

Slips is dependent on three major elements:
Slips depends on three major elements:

- Python 3.10.12
- Zeek 8.0.0
- Redis database 7.0.4

To install these elements we will use APT package manager. After that, we will install python packages required for Slips to run and its modules to work. Also, Slips' interface Kalipso depend on Node.JS and several npm packages.

To install these elements, the script will use the APT package manager. After that, it will install python packages required for Slips to run and its modules to work. Also, Slips' interface Kalipso depend on Node JS and several npm packages.


**Instructions to download everything for Slips are below.**
<br>

### Install Slips using shell script
You can install it using install.sh
You can install it using [install.sh](https://github.com/stratosphereips/StratosphereLinuxIPS/blob/master/install/install.sh)

sudo chmod +x install.sh
sudo ./install.sh


### Installing Slips manually
#### Installing Python, Redis, NodeJs, and required python and npm libraries.

Expand Down Expand Up @@ -314,6 +313,7 @@ You can kill this redis database by running:
```
then choosing 1.

After these steps, if you need the submodules, you will need to clone them as done in the `install.sh` script.


## Installing Slips on a Raspberry PI
Expand Down
9 changes: 9 additions & 0 deletions docs/web_visualization.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# Slips Web Visualization

To see the alerts of Slips in a visual way, the methodology is the following

1. Slips must be configured to export the alerts in STIX format to a TAXII server, as explained in [exporting](https://stratospherelinuxips.readthedocs.io/en/develop/exporting.html).
2. You need to install a TAXII server (available in the SlipsWeb submodule folder). See its README.md
3. Use the program `SlipsWeb` that is availbale in the StratosphereWeb submodule that reads from the TAXII server.

All the setup does not consume many resources, so you can run this visualization even in small servers like a Raspberry Pi. However, by having many Slips exporting to the same server you can centralize the visualization of many sensors in a unique location, probably with more hardware if needed.
2 changes: 1 addition & 1 deletion install/install.sh
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ ZEEK_REPO_URL="download.opensuse.org/repositories/security:/zeek/xUbuntu_${UBUNT
# Add the repository to the sources list
echo "deb http://${ZEEK_REPO_URL}/ /" | tee /etc/apt/sources.list.d/security:zeek.list \
&& curl -fsSL "https://${ZEEK_REPO_URL}/Release.key" | gpg --dearmor | tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null \
&& sudo apt update && sudo apt install -y --no-install-recommends zeek
&& sudo apt update && sudo apt install -y --no-install-recommends --fix-missing zeek-8.0

# create a symlink to zeek so that slips can find it
ln -s /opt/zeek/bin/zeek /usr/local/bin/bro
Expand Down
1 change: 1 addition & 0 deletions install/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ pandas==2.3.3
tzlocal==5.3.1
cabby==0.1.23
stix2==3.0.1
taxii2-client==2.3.0
certifi==2025.10.5
tensorflow==2.16.1
Keras
Expand Down
26 changes: 17 additions & 9 deletions modules/exporting_alerts/exporting_alerts.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ def init(self):
self.stix = StixExporter(self.logger, self.db)
self.c1 = self.db.subscribe("export_evidence")
self.channels = {"export_evidence": self.c1}
self.print("Subscribed to export_evidence channel.", 1, 0)

def shutdown_gracefully(self):
self.slack.shutdown_gracefully()
Expand All @@ -35,18 +36,23 @@ def pre_main(self):
export_to_slack = self.slack.should_export()
export_to_stix = self.stix.should_export()

if not export_to_slack and not export_to_stix:
self.print(
"Exporting Alerts module disabled (no export targets configured).",
0,
2,
)
return 1

if export_to_slack:
self.slack.send_init_msg()

if export_to_stix:
if export_to_stix and self.stix.is_running_non_stop:
# This thread is responsible for waiting n seconds before
# each push to the stix server
# it starts the timer when the first alert happens
self.stix.start_exporting_thread()

if not export_to_slack or export_to_stix:
return 1

def remove_sensitive_info(self, evidence: dict) -> str:
"""
removes the leaked location co-ords from the evidence
Expand All @@ -63,18 +69,20 @@ def main(self):
# a msg is sent here for each evidence that was part of an alert
if msg := self.get_msg("export_evidence"):
evidence = json.loads(msg["data"])
self.print(
f"[ExportingAlerts] Evidence {evidence.get('id')} "
f"type={evidence.get('evidence_type')} received.",
2,
0,
)
description = self.remove_sensitive_info(evidence)
if self.slack.should_export():
srcip = evidence["profile"]["ip"]
msg_to_send = f"Src IP {srcip} Detected {description}"
self.slack.export(msg_to_send)

if self.stix.should_export():
msg_to_send = (
evidence["evidence_type"],
evidence["attacker"]["value"],
)
added_to_stix: bool = self.stix.add_to_stix_file(msg_to_send)
added_to_stix: bool = self.stix.add_to_stix_file(evidence)
if added_to_stix:
# now export to taxii
self.stix.export()
Expand Down
Loading
Loading