A forensics intelligence platform that bridges CTI and DFIR by storing threat intelligence and enabling bulk observable searches and threat-focused analysis.
Yeti is a Forensics Intelligence platform that bridges the gap between Cyber Threat Intelligence (CTI) and Digital Forensics and Incident Response (DFIR) teams. It solves the problem of searching for previously seen artifacts and correlating Indicators of Compromise (IOCs) across threats by providing a centralized intelligence repository and analysis pipeline. The platform enables bulk observable searches, threat-focused investigations, and automation through APIs.
DFIR teams, CTI analysts, and security operations professionals who need to manage threat intelligence, conduct forensic investigations, and automate security workflows.
Developers choose Yeti because it unifies CTI and DFIR workflows in a single platform, offers flexible data integration and export, and provides automation capabilities through its web API, reducing manual effort and improving investigation efficiency.
Your Everyday Threat Intelligence
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Enables searching observables in bulk to determine threat nature and locate artifacts, directly addressing the pain point of 'where have I seen this artifact before?' as stated in the README.
Allows focusing on specific threats to list associated TTPs, malware, and DFIR artifacts, streamlining investigation workflows highlighted in the key features.
Supports easy incorporation of internal data sources and custom logic, providing flexibility for diverse security environments, as emphasized in the README's philosophy.
Offers a web API for automating queries and enrichment, integrating with incident management platforms and sandboxes, which is a core feature for reducing manual effort.
As a comprehensive platform, setting up Yeti requires significant configuration, including backend databases and custom integrations, which may not be trivial for smaller teams.
It is tightly coupled to DFIR and CTI workflows, making it unsuitable for general-purpose data analysis or non-security applications, restricting its broader adoption.
The README links to external documentation but lacks detailed setup guides, assuming users have prior knowledge of security tools and concepts, which can hinder onboarding.