Yeti
Yeti is a free, open-source Forensics Intelligence platform for digital forensics and incident response teams.
What Yeti is
Yeti is a free, open-source Forensics Intelligence platform for digital forensics and incident response teams. It connects threat-intelligence and DFIR work by organizing observables, entities, and indicators into linked threat graphs. The platform stores DFIQ objects, forensic artifact definitions, Sigma and Yara rules, reusable queries, and technical or tactical CTI. Teams can bulk-search observables, inspect TTPs, malware, and related artifacts for a threat, then add their own sources, analytics, and logic. Indicators support Regex and Yara matching in the web interface, while Query and Sigma indicators can automate work with other systems. Python tasks run scheduled or on-demand analytics and feeds. Exports can render selected observables with Jinja templates or user-defined formats for SIEM and DFIR applications. A REST API imports observables from text, files, and URLs. Supported installation uses Docker containers with Git, Docker, and Docker Compose.
Good
- Links observables into threat graphs
- Stores Sigma and Yara rules
- Bulk-searches observables
- REST API supports text and URL imports
- Scheduled Python analytics and feeds
Watch out
- Documented installation requires Docker tooling
- Self-hosted server deployment is required
- Some indicators target external automation systems
Who it suits
Yeti suits DFIR and CTI teams managing shared threat data, forensic artifacts, and automated analysis. It is aimed at organizations able to operate a Docker-based self-hosted deployment.
Verdict
Yeti provides a broad data model for connecting threat intelligence with forensic workflows. Its value depends on a team’s ability to deploy and integrate the platform.
The facts
Each one read from Yeti's own pages, with the date it was checked.
What it does
- API
- Yeti provides a REST API, including endpoints for importing observables from text, files, and URLs.checked 9 Oct 2026
- Automation
- Python tasks support scheduled or on-demand analytics and feeds, while exports can select observables and render them to disk with a Jinja template.checked 9 Oct 2026
- Data model
- Yeti organizes information as observables, entities, and indicators, which can be linked into threat graphs.checked 9 Oct 2026
- Data sources and exports
- Yeti can incorporate user data sources, analytics, and logic, and export data in user-defined formats for third-party SIEM and DFIR applications.checked 9 Oct 2026
- Deployment
- The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin.checked 9 Oct 2026
- Enrichment
- The documentation gives VirusTotal data enrichment as an analytics example and says analytics can be extended with private scripts.checked 9 Oct 2026
- Indicators
- Indicators can match observables and apply tags; the web UI supports text-based Regex and Yara matching, while Query and Sigma indicators are intended for automation with other systems.checked 9 Oct 2026
- Installation
- The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin.checked 9 Oct 2026
- Integration example
- Yeti documents a GitHub Monitor plugin that uses a GitHub token and a GitHub query type.checked 9 Oct 2026
- Integrations
- Yeti describes exporting data in user-defined formats for ingestion by third-party SIEM and DFIR applications.checked 9 Oct 2026
- Intelligence management
- Yeti stores and manages DFIQ objects, forensic artifact definitions, Sigma and Yara rules, reusable queries, and technical and tactical CTI.checked 9 Oct 2026
- MISP collaboration
- Yeti and the MISP Project announced collaboration using the MISP standard format and STIX to support information exchange and interoperability.checked 9 Oct 2026
- Open source
- The project’s GitHub repository identifies its license as Apache-2.0.checked 9 Oct 2026
- Purpose
- Yeti describes itself as a Forensics Intelligence platform and pipeline for DFIR teams, intended to bridge CTI and DFIR practitioners.checked 9 Oct 2026
- Search
- Yeti supports bulk searches of observables and can help identify a threat and how to find it on a system.checked 9 Oct 2026
- Threat context
- Yeti can list TTPs, malware, and related forensic artifacts for a selected threat.checked 9 Oct 2026
- Threat intelligence
- It stores technical and tactical CTI, including observables, TTPs, and campaigns, from internal or external systems.checked 9 Oct 2026
- Timesketch
- Yeti documentation describes using Query indicators with Timesketch sketches and tagging matching events.checked 9 Oct 2026
- Web interface
- The getting-started guide runs Yeti on a server and opens its web interface at localhost on port 80.checked 9 Oct 2026
Alternatives to Yeti
- 1
MISP
Free planOpen sourceWebAPILinuxSelf-hosted7.9From €7.31 a year - 2
Pulse Intelligence
Free planWebAPILinuxmacOS6.8Free plan - 3
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 4
Kaspersky Threat Intelligence Portal
Free planWebAPI6.5Free plan - 56.5From $4,550 a year
- 6
IBM X-Force Exchange
Free planWebAPI6.3Free plan