Yeti review
A free, self-hosted workspace for linking, enriching, and automating threat intelligence.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Yeti is a free, open-source threat and forensic intelligence platform for CTI and DFIR practitioners. It stores observables, entities, indicators, campaigns, threat actors, malware, forensic artifacts, Sigma rules, Yara rules, and reusable queries. Analysts can search and link intelligence objects, match observables in bulk, enrich data, import external feeds, automate processing, use a REST API, and export selected data. Its web application, API, and self-hosted deployment options fit teams that want control over technical and tactical intelligence operations.
Deployment is a clear consideration. Yeti is a Docker-based, self-hosted web application, so the team choosing it owns the environment and the operational work around running it. That model suits organizations with infrastructure capability and a preference for open-source systems, but it is less suitable for buyers seeking a vendor-managed service. The free, open-source model also makes Yeti relevant for teams that want to organize threat objects without choosing between published commercial tiers.
The strongest part of Yeti is its connected intelligence workflow. Threat graphs link objects, analytics such as VirusTotal enrich observables, scheduled or on-demand Python tasks automate processing, and user-defined exports can move selected data into downstream SIEM or DFIR tools. REST queries and imports support integration, while VirusTotal and Timesketch provide named ecosystem connections. Choose Yeti when self-hosting, object-level organization, enrichment, automation, and Sigma, Yara, or DFIQ-related workflows are priorities. Choose an alternative when your primary need is a managed platform or a wider, less specialized operational scope.
Yeti pros and cons
- Where it wins
- Stores and links observables, actors, campaigns, malware, and indicators
- Enriches observables and supports scheduled or on-demand Python tasks
- Provides REST APIs, exports, feeds, Sigma, Yara, and DFIQ workflows
- Where it doesn't
- Self-hosted Docker deployment puts setup and maintenance on the team
- Integration coverage listed for VirusTotal and Timesketch is focused
- Best suited to technical intelligence workflows rather than broad case management
Yeti fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update