Skip to content

Immune signature generation#1983

Open
eldraco wants to merge 1103 commits into
developfrom
immune-signature-generation
Open

Immune signature generation#1983
eldraco wants to merge 1103 commits into
developfrom
immune-signature-generation

Conversation

@eldraco

@eldraco eldraco commented Jun 8, 2026

Copy link
Copy Markdown
Collaborator

This is a large PR that includes the new LLM module the new LLM summary module and the Regex generation and the t_cell module.

Fixes Issue

No issues fixed in particular

Changes proposed

It adds new modules

Check List (Check all the applicable boxes)

  • My code follows the code style of this project.
  • My change requires changes to the documentation.
  • I have updated the documentation accordingly.
  • All new and existing tests passed.
  • This PR does not contain plagiarized content.
  • The title of my pull request is a short description of the requested changes.
  • My PR is based on develop branch. (mandatory)

eldraco added 30 commits June 8, 2026 09:37
@eldraco
feat: add methods to store and retrieve Tranco top domains in DBManager
d66fac8
@eldraco
feat: add methods to store and retrieve Tranco top domains in RedisDB
0cc95f2
@eldraco
feat: add support for Tranco top benign limit and import domains into…
7b876d5 
… benign corpus
@eldraco
feat: add mock for tranco_top_benign_limit in ModuleFactory tests
3e58bbb
@eldraco
feat: add tranco top benign limit configuration and import functional…
2c85bf6 
…ity in storage
@eldraco
feat: add test for updating online whitelist with top 1000 domains
53ff206
@eldraco
feat: add benign match strength threshold to regex generator configur…
8044a47 
…ation
@eldraco
feat: add benign match strength threshold for regex validation
46a0731
@eldraco
feat: add benign match strength threshold configuration and scoring d…
c12853c 
…etails
@eldraco
feat: implement strong benign match scoring and threshold configuration
a4af77d
@eldraco
feat: add regex generator benign match strength threshold configuration
4e001ce
@eldraco
feat: add benign match strength threshold configuration to regex gene…
6f4d79b 
…rator
@eldraco
feat: enhance benign match strength validation and scoring in regex g…
403a908 
…enerator tests
@eldraco
feat: enhance regex match strength reporting and scoring details in R…
11770a4 
…EADME
@eldraco
feat: refactor match strength computation and specificity measurement…
67ba2fd 
… to use dedicated functions
@eldraco
feat: enhance benign regex acceptance criteria with match-strength sc…
a7e79a3 
…oring and reporting
@eldraco
feat: add statistical analysis for regex match strength and coverage …
501c0a9 
…reporting
@eldraco
feat: enhance runtime behavior for benign string imports based on ale…
aeebee9 
…rt evidence
@eldraco
feat: enhance runtime behavior for benign string imports based on hos…
d0e3dac 
…t alert checks
@eldraco
feat: add handling for 'tw_closed' messages to import benign strings
bf50281
@eldraco
feat: add method to retrieve alternative flows by profile ID and TWID
f79942e
@eldraco
feat: add method to insert multiple benign strings and return count o…
f0896c5 
…f inserted entries
@eldraco
feat: add method to retrieve all alternative flows by profile ID and …
d070f34 
…TWID
@eldraco
feat: add 'tw_closed' channel to regex generator
fde8cfe
@eldraco
feat: add tests for handling benign string imports based on host status
cae4b79
@eldraco
feat: remove logging for rejected malformed LLM responses
165af58
@eldraco
feat: add test to ensure malformed LLM responses are dropped without …
353236e 
…error logging
@eldraco
feat: implement regex specificity measurement and match strength comp…
bc779a9 
…utation
@eldraco
feat: add EvidenceSignals configuration for evidence handling
f3bd141
@eldraco
feat: add Evidence Signals documentation for evidence handling and co…
5b3fb45 
…nfiguration
eldraco and others added 26 commits June 8, 2026 09:37
@eldraco
fix: Enhance store directory resolution in RegexGeneratorStorage for …
ad9cb20 
…persistent configurations
@eldraco
fix: Enhance store directory resolution in TCellStorage for persisten…
52fe3b6 
…t configurations
@eldraco
fix: Update default persistent store directory in regex generator tes…
87f4978 
…ts and add resolution test
@eldraco
test: Add test for report builder to resolve persistent DBs and modul…
8c35a75 
…e output paths
@eldraco
test: Add test for resolving relative persistent store directory in T…
11e7a7b 
…CellStorage
@eldraco
fix: Update .gitignore to ignore all files in the permanent directory
011fbc5
@eldraco
fix: Update T Cell store directory to include data subdirectory
3deb50d
@eldraco
fix: Update log and trace file paths to use lowercase directory names
f996d42
@eldraco
fix: Update log and trace file paths to use lowercase directory names
3848f98
@eldraco
fix: Update artifact paths in README to use lowercase directory names
9a1c336
@eldraco
fix: Set output directory for TCell module
b85d5ed
@eldraco
fix: Update module directory paths to use consistent lowercase naming
f8b753f
@eldraco
test: Add test for lowercase underscore output directory in TCell module
0d257af
@eldraco
fix: Clarify threat level distinctions in alert summary prompts
6234210
@eldraco
fix: Update prompt version and clarify threat level distinctions in a…
ace6b76 
…lert summary
@eldraco
fix: Add explicit weighting guidance for evidence threat levels in pr…
75042a0 
…ompt construction
@eldraco
fix: Enhance alert summary prompts with threat level guidance and con…
35d31ea 
…text for informational evidence
@eldraco
fix: Clarify prompt structure for alert summaries by separating curre…
a50a49d 
…nt and historical evidence context
@eldraco
fix: Update prompt version to v4 and clarify current alert evidence u…
3ba439b 
…sage in summaries
@eldraco
fix: Clarify prompt structure by separating current alert evidence fr…
213b49d 
…om historical context to prevent recursive contamination
@eldraco
fix: Update alert summary prompts to version v4 and enhance clarity o…
9d4bac9 
…n current alert evidence usage
@eldraco
feat: update regex_generator configuration for improved logging and p…
4d439b4 
…erformance
@eldraco
feat: add tests for managing available LLM backends in database
6ec1c31
@eldraco
feat: add test for generated regexes storage and retrieval in DBManager
5b8f42f
@eldraco
feat: Add recent alert history management to enhance analyst summary …
b1db3e1 
…context
@eldraco
Merge branch 'immune-signature-generation' of github.com:stratosphere…
340d733 
…ips/StratosphereLinuxIPS into immune-signature-generation

Signed-off-by: Sebastian Garcia <eldraco@gmail.com>

# Conflicts:
#	config/slips.yaml
#	modules/alert_summary/README.md
#	tests/unit/slips_files/core/database/test_database.py
@github-project-automation github-project-automation Bot moved this to Todo in Slips Jun 8, 2026
@eldraco eldraco added the Better Detection Tasks for making better detections of threats label Jun 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@AlyaGomaa AlyaGomaa

Labels

Better Detection Tasks for making better detections of threats

Projects

Slips
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@eldraco @AlyaGomaa