On the recordRead 9 Oct 202619 facts
Yeti
On the record
- API
- Yeti provides a REST API, including endpoints for importing observables from text, files, and URLs.yeti-platform.io · read 9 Oct 2026
- Automation
- Python tasks support scheduled or on-demand analytics and feeds, while exports can select observables and render them to disk with a Jinja template.yeti-platform.io · read 9 Oct 2026
- Data model
- Yeti organizes information as observables, entities, and indicators, which can be linked into threat graphs.yeti-platform.io · read 9 Oct 2026
- Data sources and exports
- Yeti can incorporate user data sources, analytics, and logic, and export data in user-defined formats for third-party SIEM and DFIR applications.yeti-platform.io · read 9 Oct 2026
- Deployment
- The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin.yeti-platform.io · read 9 Oct 2026
- Enrichment
- The documentation gives VirusTotal data enrichment as an analytics example and says analytics can be extended with private scripts.yeti-platform.io · read 9 Oct 2026
- Indicators
- Indicators can match observables and apply tags; the web UI supports text-based Regex and Yara matching, while Query and Sigma indicators are intended for automation with other systems.yeti-platform.io · read 9 Oct 2026
- Installation
- The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin.yeti-platform.io · read 9 Oct 2026
- Integration example
- Yeti documents a GitHub Monitor plugin that uses a GitHub token and a GitHub query type.yeti-platform.io · read 9 Oct 2026
- Integrations
- Yeti describes exporting data in user-defined formats for ingestion by third-party SIEM and DFIR applications.yeti-platform.io · read 9 Oct 2026
- Intelligence management
- Yeti stores and manages DFIQ objects, forensic artifact definitions, Sigma and Yara rules, reusable queries, and technical and tactical CTI.yeti-platform.io · read 9 Oct 2026
- MISP collaboration
- Yeti and the MISP Project announced collaboration using the MISP standard format and STIX to support information exchange and interoperability.yeti-platform.io · read 9 Oct 2026
- Open source
- The project’s GitHub repository identifies its license as Apache-2.0.github.com · read 9 Oct 2026
- Purpose
- Yeti describes itself as a Forensics Intelligence platform and pipeline for DFIR teams, intended to bridge CTI and DFIR practitioners.yeti-platform.io · read 9 Oct 2026
- Search
- Yeti supports bulk searches of observables and can help identify a threat and how to find it on a system.yeti-platform.io · read 9 Oct 2026
- Threat context
- Yeti can list TTPs, malware, and related forensic artifacts for a selected threat.yeti-platform.io · read 9 Oct 2026
- Threat intelligence
- It stores technical and tactical CTI, including observables, TTPs, and campaigns, from internal or external systems.yeti-platform.io · read 9 Oct 2026
- Timesketch
- Yeti documentation describes using Query indicators with Timesketch sketches and tagging matching events.yeti-platform.io · read 9 Oct 2026
