https://cybertoolchain.io/tools/yeti New releases and features in Yeti, tracked by The Cyber Toolchain. en Fri, 02 Oct 2026 18:22:44 GMT https://github.com/yeti-platform/yeti/releases/tag/2.12.0 https://github.com/yeti-platform/yeti/releases/tag/2.12.0 Fri, 02 Oct 2026 18:22:44 GMT Yeti 2.12.0 adds a Google OAuth access-token exchange endpoint, ACL-change event publishing, and editable agent persona objects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api/v2/auth/google-access-token` to exchange a Google OAuth access token for a Yeti API token, enabled only when `auth.google_access_token_client_ids` is set in `yeti.conf`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • ACL changes now publish events on the event bus — object creation emits three events (object, owner ACL, one per group in `rbac.default_acls`), and sharing/unsharing operations also publish, delivering access-control metadata to registered event tasks for the first time. • Conversational agent instructions are stored as editable persona objects, with persona writes publishing events to the event bus. • Audit logs now redact tokens and URL-encoded secrets. Breaking changes: • Object creation now emits three events where it previously emitted one (the object, its owner ACL, and one per group in `rbac.default_acls`); any event-bus consumer with a match-all `acts_on` — including the shipped `DatadogMetrics` plugin — will start receiving the new ACL events and will report a new `yeti.object` series with `type:acl`. • `yara-python` now requires >= 4.5.2; the image build fails if yara is compiled without OpenSSL support, rather than shipping a crypto-less binary. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.11.0 https://github.com/yeti-platform/yeti/releases/tag/2.11.0 Tue, 01 Sep 2026 16:52:07 GMT Yeti 2.11.0 adds per-message model selection and session deletion to the agent chat interface. • Adds `GEMINI_MODELS` to `prod/.env.example` (yeti-docker) and `agents.geminiModels` in the Helm chart to configure the list of selectable models for the agent chat. • Enables per-message model selection in agent chat, with the chosen model remembered per conversation so each session shows which model answered it. • Enables deletion of agent chat sessions, removing the conversation and its metadata together. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.10.0 https://github.com/yeti-platform/yeti/releases/tag/2.10.0 Tue, 01 Sep 2026 12:40:12 GMT Yeti 2.10.0 slims the semantic search response to {score, matched, object_summary}, cutting payload size by ~86%. • Redesigns the `POST /api/v2/search/semantic` response shape: each hit is now `{score, matched, object_summary}` instead of a full object with `semantic_score` and `matched_on` merged into it — search metadata is cleanly separated from object data. • Adds `matched` field to each hit, returning the specific matching document (e.g. for a DFIQ question matched via an approach, only that approach with its description and steps is returned, not all approaches). • Adds `object_summary` field to each hit, containing `id`, `root_type`, `type`, `name`, `description`, and `tags` — use the `id` to fetch the full object separately; `dfiq_yaml` is no longer included in responses. • Reduces `POST /api/v2/search/semantic` response size from 19,845 to 2,836 bytes (~86% reduction) on a 5-result query with identical results and ordering. Breaking changes: • The `POST /api/v2/search/semantic` response shape changed: hits are now `{score, matched, object_summary}` — the old `semantic_score` and `matched_on` fields written directly into the object are gone, and `dfiq_yaml` is no longer returned. Any client parsing the old shape will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.7.0 https://github.com/yeti-platform/yeti/releases/tag/2.7.0 Mon, 24 Aug 2026 13:03:44 GMT Yeti 2.7.0 adds a dynamic object-type discovery endpoint and bucketed, scopeable global search results. • Adds `GET /system/types` endpoint returning a dynamic list of every creatable object type in the instance. • Global search results are now bucketed by type instead of returned as one merged, unranked list. • Semantic search can now be scoped to a single object type, preventing it from crowding out other type results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.5.1 https://github.com/yeti-platform/yeti/releases/tag/2.5.1 Thu, 02 Jul 2026 09:36:26 GMT Yeti 2.5.1 adds structured JSON logging, agentic functionalities, and a new session-retrieval endpoint. • Adds structured JSON logging support for the console output. • Introduces agentic functionalities to Yeti. • New API endpoint to retrieve a session by user and session ID. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.5.0 https://github.com/yeti-platform/yeti/releases/tag/2.5.0 Mon, 18 Aug 2025 09:04:19 GMT Adds global search UI and search_multiple API endpoints for bulk queries • Adds a `Global search` entry to the application navigation menu • Adds two new REST endpoints `GET /api/v2/search/multiple` and `POST /api/v2/search/multiple` that accept an array of query objects Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.4.2 https://github.com/yeti-platform/yeti/releases/tag/2.4.2 Sun, 06 Jul 2025 18:46:52 GMT Add 'description' field to tags in Yeti 2.4.2. • Adds a `description` field to tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.3.7 https://github.com/yeti-platform/yeti/releases/tag/2.3.7 Fri, 02 May 2025 12:18:59 GMT Yeti 2.3.7 adds new find API endpoints • Adds `find` REST API endpoints for querying indicators and entities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.3.6 https://github.com/yeti-platform/yeti/releases/tag/2.3.6 Wed, 16 Apr 2025 14:09:38 GMT Adds bloom checking endpoints to Yeti • Add bloom checking endpoints Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.3.4 https://github.com/yeti-platform/yeti/releases/tag/2.3.4 Fri, 21 Mar 2025 13:31:29 GMT Yara overlays and context attributes migration to mixin • Context attributes migrated to a mixin, enabling reusable attribute definitions across entities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.3.3 https://github.com/yeti-platform/yeti/releases/tag/2.3.3 Sun, 09 Mar 2025 07:20:45 GMT Yeti 2.3.3 adds Elastic Security feed support and DFIQ object acceptance • Adds `Elastic Security` as a supported intelligence feed source for ingesting threat data. • Enables the DFIQ patch endpoint to accept full objects in addition to previous input types. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.3.0 https://github.com/yeti-platform/yeti/releases/tag/2.3.0 Tue, 18 Feb 2025 11:42:12 GMT Yeti 2.3.0 introduces RBAC and changes API key handling • Adds Role-Based Access Control (RBAC) • Changes API key generation and usage mechanics Breaking changes: • New API keys will have to be regenerated for all users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.2.2 https://github.com/yeti-platform/yeti/releases/tag/2.2.2 Mon, 06 Jan 2025 09:51:16 GMT Yeti 2.2.2 adds a beats entrypoint, timeline logging, and validator improvements. • Creates a new entrypoint for Beats to send telemetry directly to Yeti • Adds TimelineLog capability for recording chronological events within the platform Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.2 https://github.com/yeti-platform/yeti/releases/tag/2.2 Sun, 01 Dec 2024 13:22:38 GMT Yeti 2.2 adds AuthSecret observable, Datadog metrics integration, new webserver-prod command, and schema indexing • Adds `AuthSecret` as a new observable type for storing sensitive authentication credentials • Adds Datadog metrics submission listening on all events via the new `datadog_metrics` submitter • Introduces new command `webserver-prod` to run the web server in production mode • Adds index support across observables and entities for improved query performance Breaking changes: • Schema validation and loading behavior has changed; see the migration guide at https://yeti-platform.io/docs/updating/ before updating. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.13 https://github.com/yeti-platform/yeti/releases/tag/2.1.13 Thu, 24 Oct 2024 09:46:28 GMT Yeti 2.1.13 introduces ArangoDB event bus on object inserts/updates and increases max tag length to 250. • Adds `events_bus` trigger when inserting or updating objects in ArangoDB • Increases maximum tag length to 250 characters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.12 https://github.com/yeti-platform/yeti/releases/tag/2.1.12 Tue, 15 Oct 2024 12:19:07 GMT Yeti 2.1.12 adds task CLI commands, S3 export support, dynamic schema loading, and stateless auth • `yetitask` CLI subcommand group for managing internal tasks directly from the terminal. • S3 bucket integration for export input/output via `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_S3_EXPORT_BUCKET`, `AWS_S3_IMPORT_BUCKET`. Set these environment variables or in `yeti.conf`. • Dynamic schema loading for YETI objects and indicators — no restart needed after adding custom types. • `YetiPackage` JSON structure to create multiple correlated Yeti objects (Indicators, Observables, etc.) in one operation. • Stateless authentication model. Replaces the previous session-based or JWT cookie auth with token-based validation. Breaking changes: • Templates have been moved from the database to the filesystem; existing templates must be exported as Jinja files before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.11 https://github.com/yeti-platform/yeti/releases/tag/2.1.11 Tue, 10 Sep 2024 13:22:37 GMT Yeti 2.1.11 adds regex matching to `/graph/match`, `in` operator for neighbor filters, and persistent browser auth via cookie expiry. • `/graph/match` endpoint now supports regex matching instead of simple string comparison • Neighbor filter gains the new `in` operator for list-based matching • Browser authentication is now persistent by setting an expiry date on the auth cookie Breaking changes: • Default search operator changed from REGEX_TEST to CONTAINS for pattern matching Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.10 https://github.com/yeti-platform/yeti/releases/tag/2.1.10 Thu, 18 Jul 2024 20:50:17 GMT Yeti 2.1.10 adds observables delete endpoint, new DFIQ archive endpoint, and YARAify/ETOpen feeds • Adds `DELETE /api/observables/<id>` endpoint to remove observables via API • Adds `GET /api/dfiq_archive` endpoint for DFIQ-related data access • Adds `technique_id` field in MITRE technique aliases • Enables integration with YARAify feed for YARA rule management • Integrates ETOpen feed for open threat intel collection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.9 https://github.com/yeti-platform/yeti/releases/tag/2.1.9 Tue, 18 Jun 2024 15:59:42 GMT DFIQ visualization and cookie expiry limits • Adds `DFIQ details` to the entity view for improved threat intelligence context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.7 https://github.com/yeti-platform/yeti/releases/tag/2.1.7 Fri, 24 May 2024 09:54:04 GMT Yeti 2.1.7 adds SSL JA3 signature feed support, graph sorting/filtering, OIDC auth, and a DFIQ archive upload API • Adds SSL JA3 signature support including a new JA3 feed for analyzing SSL/TLS client hello traffic. • Enables sorting and filtering of graph traversal results within the UI to isolate specific relationship paths. • Introduces OIDC token authentication as an alternative auth method for accessing the service. • Adds a DFIQ API endpoint specifically for uploading archives, enabling integration with forensic workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.5 https://github.com/yeti-platform/yeti/releases/tag/2.1.5 Fri, 19 Apr 2024 12:10:22 GMT Yeti 2.1.5 adds DFIQ YAML validation API endpoints, root_type graph search filtering, and the TweetLive feed. • `API endpoints for DFIQ YAML validation` to validate DFIQ playbooks programmatically. • Graph search `root_type` parameter to select target vertices by root type during traversal. • New `TweetLive` feed integration for ingesting Twitter data into Yeti. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.4 https://github.com/yeti-platform/yeti/releases/tag/2.1.4 Thu, 07 Mar 2024 14:09:53 GMT Yeti 2.1.4 adds ForensicArtifacts indicator type, graph search hop limits, search aliases, indicator tags, link swap API, Cisco/Tranco feeds • `ForensicArtifacts` is now a supported `indicator_type`. • Graph search accepts `min` and `max` hops arguments to constrain traversal depth. • New search aliases can be configured to map custom terms to existing search queries. • Indicator objects now carry tags that allow labeling and filtering. • Registry keys are recognized within `ForensicArtifacts` data sources. • New 'Cisco Umbrella Top1M domains' feed is available for automatic ingestion of top domain lists. • New 'Tranco top domains' feed is available for automatic ingestion of ranked domain lists. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.3 https://github.com/yeti-platform/yeti/releases/tag/2.1.3 Sun, 04 Feb 2024 17:27:55 GMT Yeti 2.1.3 adds DFIQ object support, Shodan/Censys analytics, MISP JSON import, IBAN/BIC observables, and configurable patch endpoints. • `patch` endpoint added to observables for updating observable data • New `config` file precedence can be toggled relative to environment variables via config key change • New `DFIQ` object type supported in the service schema • Shodan queries now available as an `analytics` integration • Censys queries now available as an `analytics` integration • New `Wiz Threat Landscape` feed source added • Mining pools domain/IPv4 feed added for automated ingestion • MISP JSON import format supported via new import system • `IBAN` and `BIC` observable types now accepted Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.2 https://github.com/yeti-platform/yeti/releases/tag/2.1.2 Fri, 19 Jan 2024 14:01:00 GMT Yeti 2.1.2 adds PATCH /observables endpoint and envvar precedence toggle • `PATCH /observables` API endpoint added to allow updating specific observable fields without full replacement. • Config file precedence can be swapped with environment variable precedence via a new configuration option. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.1.0 https://github.com/yeti-platform/yeti/releases/tag/2.1.0 Sat, 30 Dec 2023 14:17:25 GMT Adds auditability logging, structured bulk_add responses, and user account observables to Yeti • Adds `auditability` logging to track system events • Returns more structured JSON responses from the `bulk_add` API endpoint instead of flat lists • Introduces support for the `user_account` observable type in the observables collection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.0.5 https://github.com/yeti-platform/yeti/releases/tag/2.0.5 Tue, 19 Dec 2023 17:09:32 GMT Yeti 2.0.5 adds OIDC authentication and extended attributes to the observables API • Adds OIDC (OpenID Connect) provider support for authentication • Extends the observables API to accept additional attributes when creating or updating entries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.0.4 https://github.com/yeti-platform/yeti/releases/tag/2.0.4 Fri, 08 Dec 2023 14:51:19 GMT Enable entity search by tags • Add support for searching entities by tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.0.3 https://github.com/yeti-platform/yeti/releases/tag/2.0.3 Fri, 01 Dec 2023 15:08:11 GMT Yeti 2.0.3 adds source context to feeds and an optional param to reset API key functions • Adds `source` context to feeds where it was previously missing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.0.2 https://github.com/yeti-platform/yeti/releases/tag/2.0.2 Fri, 24 Nov 2023 09:39:58 GMT Yeti 2.0.2 adds plugin auto-loading, regex/date search, and Dockerhub analytics • Add plugins loader to automagically add new ones • Add regex search for all terms • Add ability to search by date Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.0.1 https://github.com/yeti-platform/yeti/releases/tag/2.0.1 Fri, 17 Nov 2023 17:20:02 GMT Yeti 2.0.1 adds Docker image and User Agent observable types, CISA KEV feed, and vulnerability schema fields. • `docker-image` observable type • `user-agent` observable type • `base_score` field on vulnerabilities • `severity` field on vulnerabilities • `title` field on vulnerabilities • Observable matching respects the `type` parameter Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/2.0 https://github.com/yeti-platform/yeti/releases/tag/2.0 Tue, 14 Nov 2023 08:24:54 GMT Yeti 2.0 introduces ArangoDB backend, FastAPI server, Vue SPA frontend, and Sigma rule support • `docker compose` scripts provided for easy deployment in `yeti-docker` repository. • New indicator type: Sigma rules added to DFIR-related entities. • New indicator type: Queries added to DFIR-related entities. • API server switched from Flask to FastAPI / Pydantic. • Database engine switched from MongoDB to ArangoDB. • New single-page application (SPA) frontend built with VueJS. Breaking changes: • Database backend changed from MongoDB to ArangoDB; existing data requires migration. • API server implementation changed from Flask to FastAPI / Pydantic; API contract may differ. • Frontend replaced with new VueJS SPA; legacy interface no longer available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti https://github.com/yeti-platform/yeti/releases/tag/1.8.5 https://github.com/yeti-platform/yeti/releases/tag/1.8.5 Tue, 15 Feb 2022 15:47:29 GMT Yeti 1.8.5 adds five new threat intel feeds and configurable tag expiration. • Adds `dataplane` feed source to ingest Dataplane data • Adds `blocklistde` feed source for BlocklistDE intelligence • Adds `cruzit` feed source for CruzIT indicators • Adds `botvrij` feed source for Botvrij.io data • Adds `threatview` feed source for ThreatView.io indicators • Adds configurable tag expiration via the tag definition interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/yeti