Immune signature generation

.gitignore

@@ -178,7 +178,9 @@ dataset-private/*
 appendonly.aof
 /p2p_db.sqlite
 old-pipeline/
-
-
+databases/regex_store/
+utils/immune_web_sim/runs/
+config/redis.conf
+.vscode/launch.json
 # permanen p2p dbs and encryption keys
 permanent/

README.md

@@ -175,6 +175,7 @@ Slips aborts updating to new versions when there are changes to Slips local conf
 * You can also specify whether to ```train``` or ```test``` the ML models
 
 * You can enable [popup notifications](https://stratospherelinuxips.readthedocs.io/en/develop/usage.html#popup-notifications) of evidence, enable [blocking](https://stratospherelinuxips.readthedocs.io/en/develop/usage.html#slips-permissions), [plug in your own zeek script](https://stratospherelinuxips.readthedocs.io/en/develop/usage.html#plug-in-a-zeek-script) and more.
+* The `t_cell` section is enabled by default so Slips can consume centrally tagged `PAMP` and `DAMP` evidence, match extracted antigens against accepted regexes, and then carry a signal-specific priming profile into later co-stimulation and context decisions. `DAMP` can now create a weaker state-1 cell with stricter later thresholds and a shorter waiting window, while all responder state stays in its own SQLite DB.
 
 
 [More details about the config file options here]( https://stratospherelinuxips.readthedocs.io/en/develop/usage.html#modifying-the-configuration-file)
@@ -192,6 +193,10 @@ Slips key features are:
 * **HTTPS Anomaly Detection**: Adaptive TLS/HTTPS anomaly detection with drift handling and a local HTML report generator for deep dives.
 * **Integration with External Platforms**: Modules in Slips can look up IP addresses on external platforms such as VirusTotal and RiskIQ.
 * **Graphical User Interface**: Slips provides a web interface and an optional Kalipso terminal interface through the `modules/kalipso` submodule.
+* **Shared LLM Access**: Slips can expose configured LLM backends such as Ollama, OpenAI, and Anthropic to other modules through Redis channels.
+* **Hierarchical Alert Summaries**: Slips can turn correlated alert evidence into analyst-facing one-paragraph incident summaries, recursively reducing oversized evidence sets instead of truncating them.
+* **Pseudo-Random Regex Generation**: Slips can generate and validate pseudo-random regexes for DNS domains, URIs, filenames, TLS SNI, and certificate CN fields for later Zeek-side use.
+* **Immune-Style T Cell Response**: Slips can consume centrally tagged `PAMP` and `DAMP` evidence, correlate extracted antigens with accepted regexes, and use signal-specific T-cell priming plus mixed `PAMP`/`DAMP` danger pressure to decide whether to stay tolerant, activate, contain, or store long-term memory.
 * **Peer-to-Peer (P2P) Module**: Slips includes a complex automatic system to find other peers in the network and share IoC data automatically in a balanced, trusted manner. The P2P module can be enabled as needed.
 * **Docker Implementation**: Running Slips through Docker on Linux systems is simplified, allowing real-time traffic analysis.
 * **Detailed Documentation**: Slips provides detailed documentation guiding users through usage instructions for efficient utilization of its features.
@@ -222,6 +227,11 @@ We appreciate your contributions and thank you for helping to improve Slips!
 # Documentation
 [User documentation](https://stratospherelinuxips.readthedocs.io/en/develop/)
 
+T Cell design and configuration: [docs/t_cell_module.md](docs/t_cell_module.md)
+
+T Cell offline report generation and interpretation:
+[docs/t_cell_module.md#offline-html-report](docs/t_cell_module.md#offline-html-report)
+
 [Code docs](https://stratospherelinuxips.readthedocs.io/en/develop/code_documentation.html )
 
 ---