Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository. the platform will also automatically enrich observables (e.g. resolve domains, geolocate IPs) so that you don’t have to. Yeti provides an interface for humans (shiny Bootstrap-based UI) and one for machines (web API) so that your other tools can talk nicely to it.

In a nutshell, the framework allows you to:

• Submit observables and get a pretty good guess on the nature of the threat.
• Inversely, focus on a threat and quickly list all TTPs, Observables, and associated malware.
• Let responders skip the “Google the artifact” stage of incident response.
• Let analysts focus on adding intelligence rather than worrying about machine-readable export formats.
• Visualize relationship graphs between different threats.

This is done by:

• Collecting and processing observables from a wide array of different sources (MISP instances, malware trackers, XML feeds, JSON feeds…)
• Providing a web API to automate queries (think incident management platform) and enrichment (think malware sandbox).
• Export the data in user-defined formats so that they can be ingested by third-party applications (think blocklists, SIEM).

You can read more and download this tool over here: https://github.com/yeti-platform/yeti