Plain English
Ask a question in familiar language. Snowman turns plain-English search into archive text search.
Find sign-ins for [email protected] from a new locationPersistent agentic security · 24/7
Specialized AI systems continuously investigate, hunt, engineer detections, and prepare governed response across complete connected and retained security evidence.
ObserveReasonAct
High-level summary. The canonical nine-stage loop also includes planning, result inspection, reflection, memory, coordination, verification, and improvement.
Your security operation,
always working.
Yeti runs a persistent workforce of specialized security agents that monitor telemetry, investigate threats, hunt across history, engineer detections, and coordinate governed response—24/7.Yeti’s specialized security agents monitor, investigate, hunt, and coordinate governed response—24/7.
Powered by Yeti’s security inference models, Dark Matter agentic runtime, lossless connected and retained evidence, long-running memory, purpose-built security tools, and controlled execution.
Persistent agents
Security missions that keep working
Security inference
Plan, investigate, test, and adapt
Governed autonomy
Machine speed within human authority
One investigation. Evidence across your environment.
01Collect signals02Correlate detection03Investigate evidence04Approve response
Drag to rotate · Pinch or scroll to zoom
Illustrative scenario and example IPs · Select a location for asset details · Geographic data: Natural Earth
01 / Agentic investigation
An agentic investigation
that keeps working.
Yeti’s investigation agent continuously assembles related activity, tests competing explanations, identifies missing evidence, and builds a decision-ready case. From the first signal to the next action, its reasoning stays connected to inspectable evidence.
AGENTIC INVESTIGATION, CONNECTEDILLUSTRATIVE SEQUENCE
- 01 / EVIDENCE
Connect the evidence
Bring identity, endpoint, network, and cloud activity into one investigation.
IdentityEndpointCloud - 02 / ANALYSIS
Agent plans and investigates
A persistent investigation agent selects bounded tools, examines related activity, compares explanations, and follows the evidence.
CorrelateCompareReason - 03 / CASE
Explain the findings
Review a timeline and linked records. See what is observed, what is inferred, and what is still unknown.
ObservedInferredUnknown - 04 / DECISION
Choose the next action
Your team reviews the findings and takes the next step through a governed response workflow.
ReviewApproveAct
Persistent reasoning, with the proof attached.
The agent follows events across sources, keeps hypotheses and contradictions visible, and links every conclusion to the records that support it. Unknowns remain explicit instead of becoming claims.
The agent does the investigative work. Your team governs it.
The investigation agent plans, uses authorized tools, and assembles the case around the clock. Your team reviews its work and decides how to proceed, with permissions and approvals carried into response.
02 / Snowman · Agentic search & evidence
Find the log.
Understand the story.
Snowman is the shared evidence workspace for people and Yeti agents. Agents search live and retained telemetry, pivot across normalized fields and original records, and explain what the evidence supports.
SNOWMAN / AGENTIC SEARCH TO CONTEXTILLUSTRATIVE SEQUENCE
01 / Your logs
Activity from your environment.
Identity · sign-in event
Endpoint · process activity
Cloud · role change
Security events and retained log history.
02 / Focus your searchOne workspace.
One workspace.
Three ways to search.
Ask in plain English, filter security fields, or search archive text.
Find logs for [email protected]
03 / Inspect & explainFrom a matching record
From a matching record
to useful context.
09:41:02 · IdentitySign-in event
user: [email protected]
source: 192.0.2.24A Yeti agent can inspect and explain the selected record while keeping the original evidence in context.
Structured events
Search normalized security fields and pivot from identities, cases, or indicators. This example shows filters, not an executable query.
actor_user = [email protected] · class_uid = 3002Archive text
Search the log archive when the original message matters. Keep the raw context within reach.
"[email protected]" "role"Live Events
Agents and analysts watch security activity arrive and move into a focused investigation.
Connected sources
Give every authorized agent visible evidence origin, health, and collection state.
Parser Factory
Use AI to draft parsers, then test and evaluate them before wider activation.
03 / Dark Matter · Agentic security runtime
Ask a security question.
Watch the investigation happen.
Dark Matter is Yeti’s agentic security runtime. Give it a mission; Yeti Agent plans the work, selects bounded tools, streams progress, gathers evidence, and produces a view and report grounded in the result.
DARK MATTER / INVESTIGATION HARNESSILLUSTRATIVE SEQUENCE
QUESTION
Investigate the unusual access and build an evidence timeline.
Tenant-scoped · authorized sourcesYeti AgentPlans · uses tools · inspects results
1
Query security events
Identity events2
Inspect entity context
Endpoint context3
Retrieve cloud audit
Role-change recordEvidence timeline
Sign-in, endpoint activity, and role change remain linked to their original records.
What the evidence supports
Observed Access and role-change events
Inferred Possible credential compromise
Unknown Downstream data access
04 / Agentic detection + hunting
Agents build coverage.
Persistent hunters follow every lead.
Specialized detection agents turn security intent into tested coverage. Persistent hunting agents sweep retained evidence, pursue useful leads, and return durable findings with uncertainty and proof attached.
AGENTIC DETECTION ENGINEERING
Agents engineer detections. Evidence earns trust.
Detection agents identify coverage gaps, draft rules from threat behavior, replay them against tenant history, and verify runtime health. Engineers retain the approval decision.
- Draft and compile rules from security intent
- Prove positive and meaningful negative behavior
- Promote through approval and monitor runtime health
01
Define
Describe the threat behavior
02
Prove
Test it against your data
03
Operate
Deploy and monitor safely
PERSISTENT YETI HUNTER
An agentic hunt does not stop at the alert.
Give Hunter an indicator, entity, or security mission. The agent searches retained evidence, pivots across sources, tests a hypothesis, and returns a finding that separates observations, inference, uncertainty, and the next lead.
- Run hunts on demand or as scheduled missions
- Pivot across identity, endpoint, cloud, and network evidence
- Keep findings, coverage, and follow-up work together
QUESTION
Where has this indicator appeared?
30-day retained historyEVIDENCE PIVOTS
Identity2 sightings
Endpoint1 host
Cloud1 role change
Network3 connections
HYPOTHESIS
One campaign links the activity.
Evidence coverage: 4 domains · 1 unknown retained
Contradictions checkedFINDING
Related activity found
Evidence, uncertainty, and coverage stay attached.
Open run → Create case05 / Agentic response + access
Agentic response at machine speed.
Never outrun authority.
Response agents prepare, validate, and coordinate the next action across playbooks and security tools. Yeti Access evaluates every human and agent against explicit identity, scope, policy, and approval.
CONTROLLED AGENTIC RESPONSE
From evidence to action—with every safety decision preserved.
Analysts and response agents can propose an action. Yeti resolves the target, checks scope and safety, obtains the required decision, runs through the approved connector, and records exactly what happened.
- Branching playbooks, enrichment, approvals, and agentic orchestration
- Protect lists, readiness checks, budgets, refusal, and fail-closed safety
- Time-boxed containment, rollback, durable runs, and exportable evidence
PROPOSED ACTIONContain compromised identityEvidence and target attached
Scopeauthorized
Targetresolved
Safetyallowed
Approvalrecorded
Connectorready
RECORDED OUTCOMEAction executedVendor result · audit proof · rollback path
YETI ACCESS
One authority system for every human, workload, and AI agent.
Every agent has an identity. Roles define capabilities. Scopes define where those capabilities apply. Requests, approvals, expiry, reviews, and governance keep powerful access temporary, explainable, and continuously accountable.
- Identities, groups, roles, providers, partners, and workload principals
- Site and source scopes, delegation, temporary grants, and mutation preview
- Access reviews, guardrails, activity history, and tamper-evident proof
Your environment. Your agentic security operation.
Put Yeti’s security agents to work
with your evidence.
See persistent agents investigate, hunt, engineer detections, and prepare governed response across your security evidence.
Agent-ready evidenceOriginal records stay available to every authorized mission.
Agent-scoped authorityIdentity and scope are evaluated before protected operations.
Governed agentic responsePolicy, approval, execution, and evidence remain distinct.
Evaluate the operating system
What Yeti claims—and the boundary of every claim.
A security buyer or AI evaluator should not have to guess what “agentic,” “24/7,” “autonomous,” or “customer-controlled” means.
24/7 means
Persistent software agents, not a renamed chatbot or bundled MDR claim.
Agents can run continuously and on schedules across live and retained evidence. Every mission still has identity, tenant and entity scope, authorized tools, budgets, stop conditions, policy, and audit.
Autonomy means
Unattended investigation; governed mutation.
Agents may search, pivot, enrich, test hypotheses, and prepare response inside effective authority. Consequential execution remains a distinct state and follows configured policy and approval.
Evidence means
Original records stay connected to every conclusion.
Observed, inspected, executed, inferred, proposed, approved, unknown, and reconciled states remain separate. Missing evidence stays unknown instead of becoming false certainty.
Customer control means
Your environment, evidence, keys, policy, and authority.
Yeti operates across customer-controlled cloud, hybrid, sovereign, site, and air-gapped deployment models. Exact topology and connector fit are verified for the customer environment.
Inspect the complete evaluation contract.
Operating loop, mission example, autonomy matrix, deployment boundaries, capability catalog, and canonical machine context.