Yeti
Yeti: A free, self-hosted workspace for linking, enriching, and automating threat intelligence. Ranked #24 of 32 in Threat Intelligence Platforms by our editors (7.4/10); pricing: Free plan; best for self-hosted teams organizing threat objects.
At a glance
- Editor score7.4 / 10
- PricingFree plan
- Best forSelf-hosted teams organizing threat objects
- Free planYes
- Paid fromFree
- Indicator enrichmentYes
- Facts checked20 Sep 2026
Where it wins
- Stores and links observables, actors, campaigns, malware, and indicators
- Enriches observables and supports scheduled or on-demand Python tasks
- Provides REST APIs, exports, feeds, Sigma, Yara, and DFIQ workflows
Where it doesn't
- Self-hosted Docker deployment puts setup and maintenance on the team
- Integration coverage listed for VirusTotal and Timesketch is focused
- Best suited to technical intelligence workflows rather than broad case management
Our verdict on Yeti
Yeti is a free, open-source threat and forensic intelligence platform for CTI and DFIR practitioners. It stores observables, entities, indicators, campaigns, threat actors, malware, forensic artifacts, Sigma rules, Yara rules, and reusable queries. Analysts can search and link intelligence objects, match observables in bulk, enrich data, import external feeds, automate processing, use a REST API, and export selected data. Its web application, API, and self-hosted deployment options fit teams that want control over technical and tactical intelligence operations.
Deployment is a clear consideration. Yeti is a Docker-based, self-hosted web application, so the team choosing it owns the environment and the operational work around running it. That model suits organizations with infrastructure capability and a preference for open-source systems, but it is less suitable for buyers seeking a vendor-managed service. The free, open-source model also makes Yeti relevant for teams that want to organize threat objects without choosing between published commercial tiers.
The strongest part of Yeti is its connected intelligence workflow. Threat graphs link objects, analytics such as VirusTotal enrich observables, scheduled or on-demand Python tasks automate processing, and user-defined exports can move selected data into downstream SIEM or DFIR tools. REST queries and imports support integration, while VirusTotal and Timesketch provide named ecosystem connections. Choose Yeti when self-hosting, object-level organization, enrichment, automation, and Sigma, Yara, or DFIQ-related workflows are priorities. Choose an alternative when your primary need is a managed platform or a wider, less specialized operational scope.
Your product? Our editors can test Yeti in depth and publish a review, labelled as paid · from $149/mo →
Yeti pricing
Yeti fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Indicator enrichment | Yes |
| STIX/TAXII support | Not verified |
| Report management | Not verified |
| Workflow automation | Yes |
| Case management | Not verified |
| Deployment | Self-hosted |
| Deployment | Self-hosted |
| Platforms | Web |
| Support | Docs, Community |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 2 integrations: VirusTotal, Timesketch |
| Pricing | Free plan |
| Website | yeti-platform.io |
| Facts checked | 20 Sep 2026 |
Yeti integrations
Yeti lists 2 integrations on its own site.
- VirusTotal
- Timesketch
Alternatives to Yeti
- Anomali PlatformA broad enterprise TIP combining intelligence operations, telemetry, cases, automation, and AI.9.3
- Recorded Future Intelligence CloudA broad intelligence platform for teams that need risk context across security workflows.9.2
- Group-IB Threat Intelligence PlatformA broad cloud platform for actor research, dark-web monitoring, leaks, and intelligence operations.9.0
Used Yeti? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Yeti for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Yeti is listed in our Threat Intelligence Platforms directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/yeti/"><img src="https://www.itechguides.com/best/badge/yeti.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update