| Keybase | https://tomchop.keybase.pub/mastodon.html |
| GitHub | https://github.com/tomchop |
tomchop
@tomchop@infosec.exchange
- 1.1K Followers
- 412 Following
- 120 Posts
Digital Forensics & Incident Response
@ Google by day; threat intel and malware analysis by night. CertSG alumn. #BlueTeam #DFIR #CTI • Views are my own • he/him
@hacktobeer Hahaha perfect, I'm pretty sure a lot of people will be in agreement. Maybe the discount should be capped?
@benmontour no worries at all! Thanks for putting time into this. Sounds pretty cool, looking forward to what you’re coming up with!
@benmontour Here's the link! https://github.com/yeti-platform/yeti/discussions/919
@benmontour hey! That’s a very good point. We have some normalization requirements (like having “source” in context, which you’ve fixed- thanks for that :)) but other than that not really. Even the links between entities are a bit free form; the idea was to stay very flexible. I’d say let’s move this to a GitHub discussion to see where we’re lacking and what we can bring in.
@benmontour sure thing! Thanks for bringing it up :)
@benmontour hey, thanks a lot! This sounds like a bug indeed, you’re supposed to be able to do exactly that (attribute=blah). It’s probably because we do a 1:1 match and not really a substring search. Do you mind opening an issue in the repo so we can track it? https://github.com/yeti-platform/yeti/issues otherwise I’ll get to it tomorrow. Thanks!!
Please feel free to use (and tell us when you do! we love hearing about people's use-cases), file lots of bugs, and feel free to contribute: guides, documentation, even cool screenshots, everything is welcome.
We are looking forward to integrating formats such as https://dfiq.org, shipping tighter integrations with DFIR platform tools like
@TimesketchProj,
@TurbiniaProj and CTI platforms like @MISPProject
(and hopefully many more!)
The changes in the codebase have been massive (remember, it's only 2 people working on this): 480 commits to the API server
This version marks the start of a focus shift away from classic CTI and towards a platform for DFIR teams wishing to integrate CTI in their pipelines for incident response, threat hunting, and detection, and to be able to collate "forensics intelligence" to share with other teams.
Ben Montour 