$ show yeti-platform/yeti
Yeti is a threat intelligence platform that ingests, enriches, correlates, and stores cyber threat observables, entities, indicators (YARA, Sigma, Suricata, regex, forensic artifacts), and DFIQ investigative questions. It provides a FastAPI-based REST API for CRUD operations, graph traversal, semantic search (via ChromaDB), and RBAC. The system uses ArangoDB as its primary graph/document database, Redis for message brokering, and Celery for background task scheduling. It includes a plugin architecture for feeds (30+ public sources like MITRE ATT&CK, CISA KEV, MISP, AbuseIPDB) and analytics (Shodan, Censys, VirusTotal, etc.). The codebase is well-structured with clean abstractions (ArangoYetiConnector, event system, polymorphic schemas, migration framework) but contains deprecated plugins and some configuration drift. It is primarily an application, not a data research project.
The LLM identified 4 files worth highlighting for reuse:
Provides ArangoYetiConnector, a base class for all persisted schemas with generic CRUD (save, get, find, filter, list, delete), graph operations (link_to, neighbors), ACL filtering, and conflict-retry AQL. This is a reusable database abstraction layer that can be extracted for any ArangoDB-backed application.
Defines base Pydantic models (YetiBaseModel, YetiContextModel, YetiAclModel, YetiTagModel) with tag normalization, context management, ACL resolution, and event publishing. Demonstrates a clean mixin pattern for shared behavior across all domain objects.
Implements an event system with producer (Redis-based) and consumer (multiprocessing) for object creation, update, deletion, and link changes. The pattern is self-contained and could be reused as a generic event bus for any application needing real-time change propagation.
Provides reusable CRUD endpoint logic for FastAPI: search with filtering, pagination, sorting, and bulk operations. It is parameterized by schema and connector, making it adaptable to any resource type in a FastAPI application.