vault

Organize a persistent forensic knowledge base with YAML frontmatter and wiki structure.

Updated Apr 20, 2026

Search Tags:#investigation #obsidian #vault #forensics #knowledge-base #ioc #ttp

Ready to run

npx skills add https://github.com/DCx7C5/cybersecsuite --skill vault-dcx7c5

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vault
Source: https://github.com/DCx7C5/cybersecsuite/tree/main/.claude/skills/vault
Command: npx skills add https://github.com/DCx7C5/cybersecsuite --skill vault-dcx7c5

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CyberSecSuite vault scaffolds and maintains a persistent forensic knowledge base that organizes threats, actors, IOCs, TTPs, cases, and findings, making investigations repeatable and searchable.

Core Features & Use Cases

Scaffolds a structured Obsidian vault with wiki, hot cache, and memory tools for ongoing investigations.
Provides vault-ingest, vault-query, vault-lint sub-skills to support ingestion, search, and quality checks.
Enables long-term knowledge management, linking findings to cases and entities for rapid retrieval.

Quick Start

Scaffold a new vault named vault and begin ingesting sources with vault_ingest.

Frequently Asked Questions about vault

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I organize a persistent forensic knowledge base for threat actors and IOCs?▼

You can organize a persistent forensic knowledge base by scaffolding a structured vault that collects threat actors, IOCs, TTPs, cases, and findings. This approach enforces YAML frontmatter and an append-only log to maintain a living investigative repository.

What is the best way to structure long-term cyber investigations and threat findings?▼

The best way to structure long-term investigations is using a wiki structure with hot cache and memory tools. This scaffolding links findings to cases and entities for rapid retrieval, making complex investigations repeatable and searchable.

How do I ingest and query threat intelligence data in an Obsidian vault?▼

You ingest and query threat intelligence data using modular sub-skills like vault-ingest and vault-query. These tools support ongoing investigative workflows by enabling data ingestion and search within the structured wiki repository.

Does the vault knowledge base support quality checks for forensic notes?▼

Yes, the vault knowledge base supports quality checks through the vault-lint sub-skill. It enforces YAML frontmatter in notes and performs linting to ensure your forensic repository maintains strict structural integrity.

Can I use canvas boards to map TTPs and cases during an investigation?▼

Yes, you can use canvas boards to map TTPs and cases. The knowledge base supports canvas boards alongside an append-only log and structured wiki to visually maintain and scaffold ongoing investigative workflows.

Why does my forensic knowledge base require YAML frontmatter and an append-only log?▼

Your forensic knowledge base requires YAML frontmatter and an append-only log to enforce structure and maintain data integrity. These constraints ensure investigative findings remain organized, searchable, and persistently linked to their parent cases.