{"repo":"yeti-platform/yeti","free":true,"listed":false,"github":"https://github.com/yeti-platform/yeti","clone":"git clone https://github.com/yeti-platform/yeti.git","description":"Your Everyday Threat Intelligence","language":"Python","stars":2016,"topics":["infosec","threatintel","threat-sharing","threat-hunting","enrichment","intelligence","dfir"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"Yeti Platform Yeti aims to bridge the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline for DFIR teams. It was born out of frustration of having to answer the question \"where have I seen this artifact before?\" or \"how do I search for IOCs related to this threat (or all threats?) in my timeline?\" Documentation links: Main website: https://yeti-platform.io/ Documentation Guides What is Yeti? In a nutshell, Yeti allows you to: - Bulk search observables and get a pretty good guess on the nature of the threat, and how to find it on a system. - Inversely, focus on a threat and quickly list all TTPs, malware, and related DFIR artifacts. - Let CTI analysts focus on adding intelligence rather than worrying about machine-readable export formats. - Incorporate your own data sources, analytics, and logic very easily. This is done by: - Storing technical and tactical CTI (observables, TTPs, campagins, etc.) from internal or external systems. - Being a backend for DFIR-related queries: Yara signatures, Sigma rules, DFIQ. - Providing a web API to automate queries (think incident management platform) and enrichment (think malware sandbox). - Export the data in user-defined formats so that they can be ingested by third-party applications (SIEM, DFIR platforms). Some screenshots","default_branch":null,"files":null,"tree":[],"storefront":"/r/yeti-platform","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/yeti-platform/yeti/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}