yeti-platform / yeti

Your Everyday Threat Intelligence
https://yeti-platform.io/
Apache License 2.0
1.76k stars 291 forks source link

Add Yeti Package to create several objects defined as json #1140

Closed udgover closed 1 month ago

udgover commented 2 months ago

This PR brings Yeti Package to easily create a bundle of mixed yeti objects. It supports:

Here's one example:

{
   "timestamp": "2024-09-24T08:31:29.312Z",
   "source": "honeypot",
   "tags": {
      "global": ["honeypot", "exploitation"],
      "88.173.200.156": ["one_tag"]
   }
   "observables": [
      {
         "value": "88.173.200.156",
         "type": "ipv4"
      },
      {
         "value": "Go-http-client/1.1",
         "type": "user_agent"
      },
      {
         "value": "ubuntu:18.04",
         "type": "docker_image"
      },
      {
         "value": "/bin/bash",
         "type": "command_line"
      }
   ],
   "entities": [
      { 
         "name": "docker malicious campaign",
         "type": "campaign",
         "description": "### Docker container creation attempt\n* ```ubuntu:18.04```\n* ```/bin/bash```\n"
      }
   ],
   "indicators": {},
   "relationships": {
         "docker malicious campaign": [
            {
               "target": "88.173.200.156",
               "link_type": "observes"
            },
            {
               "target": "ubuntu:18.04",
               "link_type": "creates"
            },
            {
               "target": "/bin/bash",
               "link_type": "executes"
            },
         ],
         "88.173.200.156": [
            {
               "target": "Go-http-client/1.1",
               "link_type": "uses"
            },
            {
               "target": "ubuntu:18.04",
               "link_type": "creates"
            },
            {
               "target": "/bin/bash",
               "link_type": "executes"
            }
         ]
      }
}

This package will create a campaign named "docker malicious campaign" with the following observables:

The following relationships will also be created:

The campaign itself will be linked with:

All elements will be tagged with honeypot and exploitation and 88.173.200[.]156 will be tagged with one_tag