DOCSEARCHbyAlgolia
Submit Docs

Yeti Platform Documentation

repository·main·Indexed 24 days ago

https://github.com/yeti-platform/yeti

Yeti is a Forensics Intelligence platform (version 0.1.0) that bridges Cyber Threat Intelligence (CTI) and Digital Forensics and Incident Response (DFIR). It provides a pipeline for managing observables, TTPs, and campaigns, serving as a centralized backend for threat intelligence queries and data enrichment. The platform supports extensibility through plugins for feeds and analytics, includes a CLI tool (yetictl) for user and task management, and offers Docker-based deployment for production and development.

Tokens
2.6K
Snippets
5
Records
18
Agent score
84%

What's inside Yeti

  1. Overview of the Yeti Platform

    main

    Yeti is a Forensics Intelligence platform designed to bridge the gap between Cyber Threat Intelligence (CTI) and Digital Forensics and Incident Response (DFIR) practitioners. It provides a pipeline for DFIR teams to search for indicators of compromise (IOCs) within timelines and relate artifacts to known threats.

    Key capabilities include:

    • Bulk Observable Searching: Identify the nature of a threat and how to locate it on a system based on observables.
    • Threat-Centric Analysis: Quickly list TTPs, malware, and related DFIR artifacts associated with a specific threat.
    • CTI Enrichment: Allows CTI analysts to focus on intelligence rather than machine-readable export formats.
    • Extensibility: Easily incorporate custom data sources, analytics, and logic.

    Yeti functions by storing technical and tactical CTI (observables, TTPs, campaigns, etc.), acting as a backend for DFIR-related queries (such as Yara signatures, Sigma rules, and DFIQ), providing a web API for automation, and exporting data in user-defined formats for ingestion by SIEMs or other DFIR platforms.

  2. What the IVRE analytics plugin provides

    main

    The IVRE plugin integrates IVRE's data into YETI via two main analytics: IVRE - MaxMind and IVRE - Passive.

    IVRE - MaxMind

    Uses the IVRE API to fetch information from MaxMind databases to provide:

    • Estimated geographic location of IP addresses.
    • Autonomous System (AS) information for IP addresses.

    IVRE - Passive

    Uses IVRE's passive data to create the following links and observables:

    • DNS Responses: Links IP addresses to hostnames and vice versa (Private Passive DNS).
    • X509 Certificates:
      • IP addresses $\leftrightarrow$ Certificates.
      • Certificates $\leftrightarrow$ Hostnames and IP addresses (via Subject and Subject Alternative Names).
      • Certificates $\leftrightarrow$ Subjects and Issuers (using the CertificateSubject observable type).
      • Certificate subjects $\leftrightarrow$ other certificates (sharing the same issuer or subject).
    • HTTP Headers:
      • IP addresses $\leftrightarrow$ Hostnames (via Host: headers).
      • IP addresses $\leftrightarrow$ User-Agent values.
      • IP addresses $\leftrightarrow$ Server header values.

  4. Structure a plugin contribution for the contrib directory

    main

    Plugins (such as feeds or analytics) are hosted in the contrib directory. To ensure your contribution is easy to test and merge, follow this specific directory structure. Your contribution should reside in its own subdirectory under feeds or analytics.

    Required components:

    1. [plugin_name].py: The core logic of your contribution.
    2. config.txt: Any extra configuration sections that need to be included in the main Yeti configuration file.
    3. requirements.txt: A list of any additional Python libraries required by your plugin.
    4. README.md: A description and installation instructions for your plugin.
    contrib
├── README.md
└── feeds                     # Could also be "analytics", create it if you must.
    └── my_feed               # Your main contribution directory. Your code goes in here.
        ├── my_feed.py        # 1. The core of your contribution!
        ├── config.txt        # 2. Any extra configuration sections that need to go in the config file.
        ├── requirements.txt  # 3. Any additional python library your code uses.
        └── README.md         # Please provide a descirption & explanation on how to install your plugin.

  5. Add new icons to Yeti core

    main

    If your core contribution requires new icons, you should add them using the Fontello workflow to ensure they are correctly integrated into the project's font files.

    1. Navigate to fontello.com.
    2. Upload the existing config.json file found in core/web/frontend/staticfiles/yeti/font to preserve current icon sets.
    3. Add your new icons to the set.
    4. Download the new font files and the updated config.json.
    5. Replace the existing files in the repository with your downloaded versions.
    6. Reference the new icons in your code.

  6. Install the IVRE analytics plugin for YETI

    main

    The IVRE plugin allows YETI to use data from the IVRE network recon framework to enrich investigations with geographic location, AS information, DNS responses, X509 certificates, and HTTP headers.

    To install, you must link the plugin file to YETI's private analytics directory, install the required Python dependencies, and ensure IVRE has its IP data downloaded. Run these commands from the YETI source directory within your active virtual environment:

    ln -s ../../../contrib/analytics/ivre_api/ivre_api.py plugins/analytics/private/
pip install -r contrib/analytics/ivre_api/requirements.txt
ivre ipdata --download

  10. Configure private analytics feeds

    main
    To implement private analytics within Yeti, place your custom analytics logic or data feeds in the plugins/analytics/private/ directory. This directory is specifically designated for private implementations to prevent accidental commits of sensitive or local-only analytics code, as it includes a .gitignore file.