FREEDOM251

Freedom251 › Threat Intelligence Platforms

Yeti

Free plan APISelf-hostedWeb

Visit Yeti Alternatives

What Yeti is

Yeti is a free Forensics Intelligence platform and pipeline for digital forensics and incident response teams. It is designed to connect CTI and DFIR work by organizing technical and tactical threat intelligence, including observables, TTPs, and campaigns. Its data model connects observables, entities, and indicators into threat graphs. Yeti also manages DFIQ objects, forensic artifact definitions, Sigma and Yara rules, and reusable queries. Teams can bulk-search observables and inspect the TTPs, malware, and forensic artifacts associated with a selected threat. The REST API can import observables from text, files, and URLs. Python tasks support scheduled or on-demand analytics and feeds, while exports can render selected observables to disk or produce user-defined formats for third-party SIEM and DFIR applications. Indicators can match observables and apply tags; the web interface supports Regex and Yara matching. Installation documentation specifies Docker containers and requires Git, Docker, and the Docker Compose plugin. Yeti can incorporate user data sources, analytics, and logic, and the project identifies its license as Apache-2.0. Its platforms include API, self-hosted, and web.

Who it suits

Yeti suits DFIR teams that need to organize threat intelligence and forensic artifacts alongside observable searches and automated analytics. It is also relevant to teams integrating intelligence with SIEM or DFIR applications.

What it does well

  • Free plan is available.
  • REST API imports observables from text, files, and URLs.
  • Python tasks can run analytics and feeds.
  • Exports support user-defined formats.
  • Regex and Yara indicators can match observables.

What to know first

  • Documented installation requires Git and Docker.
  • Docker Compose plugin is also required.
  • The documented setup runs on a server.

Getting started

  1. Install Git, Docker, and the Docker Compose plugin
  2. Use the supported Docker-container installation
  3. Run Yeti on a server
  4. Open the web interface at localhost on port 80
  5. Import observables through the REST API or add data sources
  6. Connect integrations such as the documented GitHub Monitor plugin

Verdict

Yeti combines threat intelligence organization with DFIR-focused searching, indicators, and automation. Its documented installation requires a Docker-based setup and associated tools.

Questions

Is Yeti free?

Yes. Yeti has a free plan.

Where can Yeti run?

Yeti is offered through an API, self-hosted deployment, and web interface.

What does Yeti store?

It stores observables, entities, indicators, technical and tactical CTI, DFIQ objects, forensic artifact definitions, Sigma and Yara rules, and reusable queries.

Does Yeti provide an API?

Yes. Its REST API includes imports for observables from text, files, and URLs.

Can Yeti enrich indicators?

Yes. Analytics can enrich data; VirusTotal is documented as an example, and private scripts can extend analytics.

Facts from Yeti's own pages

API
Yeti provides a REST API, including endpoints for importing observables from text, files, and URLs. · yeti-platform.io, 9 Oct 2026
Automation
Python tasks support scheduled or on-demand analytics and feeds, while exports can select observables and render them to disk with a Jinja template. · yeti-platform.io, 9 Oct 2026
Data model
Yeti organizes information as observables, entities, and indicators, which can be linked into threat graphs. · yeti-platform.io, 9 Oct 2026
Data sources and exports
Yeti can incorporate user data sources, analytics, and logic, and export data in user-defined formats for third-party SIEM and DFIR applications. · yeti-platform.io, 9 Oct 2026
Deployment
The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin. · yeti-platform.io, 9 Oct 2026
Enrichment
The documentation gives VirusTotal data enrichment as an analytics example and says analytics can be extended with private scripts. · yeti-platform.io, 9 Oct 2026
Indicators
Indicators can match observables and apply tags; the web UI supports text-based Regex and Yara matching, while Query and Sigma indicators are intended for automation with other systems. · yeti-platform.io, 9 Oct 2026
Installation
The documented supported installation method uses dedicated Docker containers and requires Git, Docker, and the Docker Compose plugin. · yeti-platform.io, 9 Oct 2026
Integration example
Yeti documents a GitHub Monitor plugin that uses a GitHub token and a GitHub query type. · yeti-platform.io, 9 Oct 2026
Integrations
Yeti describes exporting data in user-defined formats for ingestion by third-party SIEM and DFIR applications. · yeti-platform.io, 9 Oct 2026
Intelligence management
Yeti stores and manages DFIQ objects, forensic artifact definitions, Sigma and Yara rules, reusable queries, and technical and tactical CTI. · yeti-platform.io, 9 Oct 2026
MISP collaboration
Yeti and the MISP Project announced collaboration using the MISP standard format and STIX to support information exchange and interoperability. · yeti-platform.io, 9 Oct 2026
Open source
The project’s GitHub repository identifies its license as Apache-2.0. · github.com, 9 Oct 2026
Purpose
Yeti describes itself as a Forensics Intelligence platform and pipeline for DFIR teams, intended to bridge CTI and DFIR practitioners. · yeti-platform.io, 9 Oct 2026
Search
Yeti supports bulk searches of observables and can help identify a threat and how to find it on a system. · yeti-platform.io, 9 Oct 2026
Threat context
Yeti can list TTPs, malware, and related forensic artifacts for a selected threat. · yeti-platform.io, 9 Oct 2026
Threat intelligence
It stores technical and tactical CTI, including observables, TTPs, and campaigns, from internal or external systems. · yeti-platform.io, 9 Oct 2026
Timesketch
Yeti documentation describes using Query indicators with Timesketch sketches and tagging matching events. · yeti-platform.io, 9 Oct 2026
Web interface
The getting-started guide runs Yeti on a server and opens its web interface at localhost on port 80. · yeti-platform.io, 9 Oct 2026

Where Yeti stands on Freedom251

Look at these too