rolandpgrolandpgCommunityยท1 Agent Skills Included

zettelforge

Persistent threat intelligence memory with entity extraction and graph search

Extracts CVEs, threat actors, IOCs, and ATT&CK techniques from analyst notes and threat reports. Resolves actor aliases like APT28 and Fancy Bear, then builds a STIX 2.1 knowledge graph with causal relationships. Eliminates lost investigation context when analysts leave and stops teams from re-researching known threats. Runs fully in-process with no API keys, so sensitive intelligence never leaves the host.
npx skills add rolandpg/zettelforge --all -g -y

All Skills in This Repository (1)

Pure Emerald Level Indicators

Frequently Asked Questions

FAQPage Schema
How to install ZettelForge?โ–ผ

Run `npx skills add rolandpg/zettelforge --all -g -y` in your terminal to install everything globally. You can also install the Python package directly with `pip install zettelforge`.

What does ZettelForge do for security teams?โ–ผ

It gives your team persistent memory for cyber threat intelligence, automatically extracting CVEs, threat actors, IOCs, and ATT&CK techniques from notes and reports. Past investigations stay searchable even after analysts leave.

Does ZettelForge resolve threat actor aliases?โ–ผ

Yes. Names like APT28, Fancy Bear, STRONTIUM, and Sofacy automatically resolve to the same actor node during both storage and recall.

Does ZettelForge need API keys or cloud access?โ–ผ

No. Embeddings, storage, and optional local LLM inference all run in-process, so no data leaves the host and it can work on air-gapped machines.

Can ZettelForge work with Claude Code?โ–ผ

Yes. It ships an MCP server that lets Claude Code query your stored threat intelligence in natural language during investigations.

Related Repositories in Data & Analytics

View All in Data & Analyticsโ†’