Plain English
Ask a question in familiar language. Snowman turns plain-English search into archive text search.
Find sign-ins for [email protected] from a new locationYeti · Enterprise security operations
See the threat.
Prove the response.
Yeti is the evidence-native security operations platform for your entire environment. It unifies telemetry, detection, investigation, threat hunting, governed AI, and controlled response without breaking the chain of proof.
One record
Lossless security evidence
Agentic work
Investigate at machine speed
Human control
Approval before impact
01 / Investigation
Understand what happened.
Know what to do next.
Yeti connects scattered security activity, investigates it with AI, and gives your team an explained case with the evidence behind it. From the first signal to the next action, the context stays together.
THE INVESTIGATION, CONNECTEDILLUSTRATIVE SEQUENCE
- 01 / EVIDENCE
Connect the evidence
Bring identity, endpoint, network, and cloud activity into one investigation.
IdentityEndpointCloud - 02 / ANALYSIS
Investigate with AI
The AI Case Analyst examines related activity, compares explanations, and follows the evidence.
CorrelateCompareReason - 03 / CASE
Explain the findings
Review a timeline and linked records. See what is observed, what is inferred, and what is still unknown.
ObservedInferredUnknown - 04 / DECISION
Choose the next action
Your team reviews the findings and takes the next step through a governed response workflow.
ReviewApproveAct
A clear story, with the proof attached.
Analysts can follow the events, understand the conclusion, and inspect the records that support it. Unanswered questions remain visible so the next step is based on what is actually known.
AI does the investigative work. Your team stays in control.
The AI Case Analyst helps assemble and explain the case. Your team can review its work and decide how to proceed, with permissions and approval requirements carried into response.
02 / Snowman · Log search & analysis
Find the log.
Understand the story.
Snowman is Yeti’s workspace for viewing, searching, and analyzing logs. Find the events that matter, inspect the original records, and ask AI to explain what you’re looking at.
SNOWMAN / FROM LOGS TO CONTEXTILLUSTRATIVE SEQUENCE
01 / Your logs
Activity from your environment.
Identity · sign-in event
Endpoint · process activity
Cloud · role change
Security events and retained log history.
02 / Focus your searchOne workspace.
One workspace.
Three ways to search.
Ask in plain English, filter security fields, or search archive text.
Find logs for [email protected]
03 / Inspect & explainFrom a matching record
From a matching record
to useful context.
09:41:02 · IdentitySign-in event
user: [email protected]
source: 192.0.2.24Ask AI to explain a log row, with the selected record as context.
Structured events
Search normalized security fields and pivot from identities, cases, or indicators. This example shows filters, not an executable query.
actor_user = [email protected] · class_uid = 3002Archive text
Search the log archive when the original message matters. Keep the raw context within reach.
"[email protected]" "role"Live Events
Watch security activity arrive and move into a focused investigation.
Connected sources
Understand where evidence comes from and the state of its collection.
Parser Factory
Use AI to draft parsers, then test and evaluate them before wider activation.
03 / Dark Matter · Agentic investigation
Ask a security question.
Watch the investigation happen.
Dark Matter is Yeti’s investigation harness. Ask naturally; Yeti Agent selects bounded tools, streams its work, gathers evidence, and creates the view and report relevant to the question.
DARK MATTER / INVESTIGATION HARNESSILLUSTRATIVE SEQUENCE
QUESTION
Investigate the unusual access and build an evidence timeline.
Tenant-scoped · authorized sourcesYeti AgentPlans · uses tools · inspects results
1
Query security events
Identity events2
Inspect entity context
Endpoint context3
Retrieve cloud audit
Role-change recordEvidence timeline
Sign-in, endpoint activity, and role change remain linked to their original records.
What the evidence supports
Observed Access and role-change events
Inferred Possible credential compromise
Unknown Downstream data access
04 / Detection + hunting
Find what matters.
Prove what you know.
Yeti turns security knowledge into dependable detections—and gives your team an AI hunter for the questions that need deeper investigation.
DETECTION ENGINEERING
Build detections you can trust.
Describe the behavior you care about. Yeti helps create and test the detection against your environment, then verifies that the approved version is running where it should.
- Write rules directly or start with an AI proposal
- Test against malicious and benign behavior
- Roll out safely and see real runtime health
01
Define
Describe the threat behavior
02
Prove
Test it against your data
03
Operate
Deploy and monitor safely
YETI HUNTER
Follow the evidence beyond the alert.
Give Hunter an indicator, entity, or security question. It searches retained evidence, follows useful leads, and returns a finding that shows what was observed, what remains uncertain, and where to continue.
- Run hunts on demand or as scheduled missions
- Pivot across identity, endpoint, cloud, and network evidence
- Keep findings, coverage, and follow-up work together
QUESTION
Where has this indicator appeared?
30-day retained historyEVIDENCE PIVOTS
Identity2 sightings
Endpoint1 host
Cloud1 role change
Network3 connections
HYPOTHESIS
One campaign links the activity.
Confidence 87% · 4 evidence domains
Contradictions checkedFINDING
Related activity found
Evidence, uncertainty, and coverage stay attached.
Open run → Create case05 / Response + access
Move quickly.
Never outrun authority.
Yeti coordinates response across people, agents, playbooks, and security tools—while Access ensures every actor can only see and do what the organization has explicitly allowed.
CONTROLLED RESPONSE
From evidence to action—with every safety decision preserved.
Analysts and AI agents can propose a response. Yeti resolves the target, checks scope and safety, obtains the required decision, runs through the approved connector, and records exactly what happened.
- Branching playbooks, enrichment, approvals, and agentic orchestration
- Protect lists, readiness checks, budgets, refusal, and fail-closed safety
- Time-boxed containment, rollback, durable runs, and exportable evidence
PROPOSED ACTIONContain compromised identityEvidence and target attached
Scopeauthorized
Targetresolved
Safetyallowed
Approvalrecorded
Connectorready
RECORDED OUTCOMEAction executedVendor result · audit proof · rollback path
YETI ACCESS
One authority system for humans, workloads, and AI agents.
Roles define capabilities. Scopes define where those capabilities apply. Requests, approvals, expiry, reviews, and governance keep powerful access temporary, explainable, and continuously accountable.
- Identities, groups, roles, providers, partners, and workload principals
- Site and source scopes, delegation, temporary grants, and mutation preview
- Access reviews, guardrails, activity history, and tamper-evident proof
Your environment. Your security operation.
See what Yeti can do
with your evidence.
Walk through your sources, a detection, an investigation, and a governed response with the Sasquatch team.
Original records retainedUnmapped input is archived instead of discarded.
Tenant-scoped authorityAccess is evaluated before protected operations.
Governed responsePolicy, approval, execution, and evidence remain distinct.