Yeti
2.12.0 open-sourceThe section your link pointed to isn't on Yeti's page any more, so we've brought you to the top.
Yeti is a Forensics Intelligence platform that stores CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. observables, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and campaigns, and provides a web API for DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems.-related queries and enrichment.
curl -s -X POST https://<yeti-host>/api/v2/auth/google-access-token \
-H 'Content-Type: application/json' \
-d '{"access_token": "<google-access-token>"}'
[auth]
google_access_token_client_ids = <oauth-client-id-1>,<oauth-client-id-2>
curl -s -X POST https://<yeti-host>/api/v2/search/semantic \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <token>' \
-d '{"query": "lateral movement via scheduled tasks", "count": 5}' | \
jq '.hits[] | {score: .score, name: .object_summary.name, type: .object_summary.type, id: .object_summary.id}'
curl -s -H 'Authorization: Bearer <token>' https://<yeti-host>/api/v2/system/types | jq .
curl -X PATCH https://yeti-server/api/v3/observables/<observable_id> -H 'Authorization: Bearer <token>' -d '{"tags": ["new-tag"]}'
Summary
Yeti is an open-source threat intelligence platform that stores, searches, and correlates observables, TTPs, malware, and other DFIR artifacts so analysts can answer "where have I seen this before?" across a timeline or an investigation. It runs as a self-hosted web application with a backend API, and its CLI can start consumer processes for ingesting and enriching data. It targets CTI and DFIR practitioners specifically, aiming to close the gap between the two rather than serving either alone, and it exports data in user-defined formats for downstream SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or DFIR tooling. First committed in 2013, it has drawn 84 contributors and seen 69 commits and 13 releases in the past year, the latest just 50 days ago, with recent work adding structured JSON logging and agentic functionality.
Yeti is a Forensics Intelligence platform that stores CTI observables, TTPs, and campaigns, and provides a web API for DFIR-related queries and enrichment.
How Yeti helps
Have I seen this observable somewhere before?
searches the full store of observables, TTPs, and artifacts for matches and returns every threat, campaign, or investigation it has been tied to
Which TTPs, malware, and artifacts belong to this threat?
pivots from a single threat or campaign entry and lists every related object stored against it, letting an analyst assemble the full picture in one pass
How do I get my Yara, Sigma, or DFIQ checks in front of the whole team without emailing files?
stores them centrally as a backend so any DFIR query against those signatures draws on the same shared, current set
How do I pull Yeti's data into my SIEM without hand-building an export?
lets data be exported in formats you define, so downstream tools ingest it in the shape they expect rather than Yeti's native shape
Which object types can I actually create or script against on this instance?
queries the instance for its full dynamic list of creatable object types, so integrations and bulk ingestion scripts know what's available before they run
Am I about to break my integration by relying on the old search response shape?
semantic search results are separated into score, matched content, and a compact object summary — code still reading the old merged fields will fail, showing exactly what changed
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for Yeti, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Yeti puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
41 entries
No entries match these filters.
- October 20261
- September 20262
- August 20262
- July 20264
- August 20251
- July 20251
- May 20251
- April 20251
- March 20252
- February 20251
- January 20251
- December 20241
- October 20244
- September 20242
- July 20241
- June 20241
- May 20241
- April 20241
- March 20241
- February 20241
- January 20241
- December 20234
- November 20233
- February 20221
- December 20201
- October 20201
Project health
Issue, contributor and maintainer activity in yeti-platform/yeti, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 3 −7 vs prior 12 months
- Maintainers 1 +0 joined · −1 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed 75% of issues opened, last 12 months
- Median time to close 26 days first maintainer reply 11 hours
- Open backlog 44 of 617 issues ever filed
- Issues opened / month 3 · 2 communitymaintainers
- Open backlog 44
- Contributors / month 2
- Commits / month 8
- Stars 2,029
- features 13%
- other 87%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Libraries its release ships
What its latest release locks, checked against known advisories.Its image installs without a frozen lockfile, so we can't tell which versions it ships.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →