Yeti

Yeti is a forensics intelligence platform and pipeline that bridges CTI and DFIR work. It was built to answer everyday questions like where an artifact has been seen before, and how to find every IOC tied to a given threat across a timeline.

It stores technical and tactical CTI such as observables, TTPs, and campaigns from internal or external sources. You can bulk-search observables to guess the nature of a threat, or pivot from a threat to list related TTPs, malware, and DFIR artifacts. It also backs queries for Yara signatures, Sigma rules, and DFIQ.

A web API automates queries and enrichment so it can plug into incident management and malware sandboxes, and exports run in user-defined formats for SIEMs and other DFIR platforms. It is self-hosted, with Docker for deployment.