Yeti

Spec sheet

Purpose

Yeti describes itself as a Forensics Intelligence platform and pipeline for DFIR teams, intended to bridge CTI and DFIR practitioners.Read 9 Oct 2026 · yeti-platform.io

Deployment

The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin.Read 9 Oct 2026 · yeti-platform.io

API

Yeti provides a REST API, including endpoints for importing observables from text, files, and URLs.Read 9 Oct 2026 · yeti-platform.io

Integrations

Yeti describes exporting data in user-defined formats for ingestion by third-party SIEM and DFIR applications.Read 9 Oct 2026 · yeti-platform.io

Automation

Python tasks support scheduled or on-demand analytics and feeds, while exports can select observables and render them to disk with a Jinja template.Read 9 Oct 2026 · yeti-platform.io

Data model

Yeti organizes information as observables, entities, and indicators, which can be linked into threat graphs.Read 9 Oct 2026 · yeti-platform.io

Data sources and exports

Yeti can incorporate user data sources, analytics, and logic, and export data in user-defined formats for third-party SIEM and DFIR applications.Read 9 Oct 2026 · yeti-platform.io

Enrichment

The documentation gives VirusTotal data enrichment as an analytics example and says analytics can be extended with private scripts.Read 9 Oct 2026 · yeti-platform.io

Indicators

Indicators can match observables and apply tags; the web UI supports text-based Regex and Yara matching, while Query and Sigma indicators are intended for automation with other systems.Read 9 Oct 2026 · yeti-platform.io

Installation

The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin.Read 9 Oct 2026 · yeti-platform.io

Integration example

Yeti documents a GitHub Monitor plugin that uses a GitHub token and a GitHub query type.Read 9 Oct 2026 · yeti-platform.io

Intelligence management

Yeti stores and manages DFIQ objects, forensic artifact definitions, Sigma and Yara rules, reusable queries, and technical and tactical CTI.Read 9 Oct 2026 · yeti-platform.io

MISP collaboration

Yeti and the MISP Project announced collaboration using the MISP standard format and STIX to support information exchange and interoperability.Read 9 Oct 2026 · yeti-platform.io

Open source

The project’s GitHub repository identifies its license as Apache-2.0.Read 9 Oct 2026 · github.com

Search

Yeti supports bulk searches of observables and can help identify a threat and how to find it on a system.Read 9 Oct 2026 · yeti-platform.io

Threat context

Yeti can list TTPs, malware, and related forensic artifacts for a selected threat.Read 9 Oct 2026 · yeti-platform.io

Threat intelligence

It stores technical and tactical CTI, including observables, TTPs, and campaigns, from internal or external systems.Read 9 Oct 2026 · yeti-platform.io

Timesketch

Yeti documentation describes using Query indicators with Timesketch sketches and tagging matching events.Read 9 Oct 2026 · yeti-platform.io

Web interface

The getting-started guide runs Yeti on a server and opens its web interface at localhost on port 80.Read 9 Oct 2026 · yeti-platform.io

Where Specifiction places it

• Threat Intelligence Platforms#27 of 326.7