vault

Organize a persistent forensic knowledge base with YAML frontmatter and wiki structure.

Updated Apr 20, 2026
One-click install
npx skills add https://github.com/DCx7C5/cybersecsuite --skill vault-dcx7c5
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: vault
Source: https://github.com/DCx7C5/cybersecsuite/tree/main/.claude/skills/vault
Command: npx skills add https://github.com/DCx7C5/cybersecsuite --skill vault-dcx7c5

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CyberSecSuite vault scaffolds and maintains a persistent forensic knowledge base that organizes threats, actors, IOCs, TTPs, cases, and findings, making investigations repeatable and searchable.

Core Features & Use Cases

  • Scaffolds a structured Obsidian vault with wiki, hot cache, and memory tools for ongoing investigations.
  • Provides vault-ingest, vault-query, vault-lint sub-skills to support ingestion, search, and quality checks.
  • Enables long-term knowledge management, linking findings to cases and entities for rapid retrieval.

Quick Start

Scaffold a new vault named vault and begin ingesting sources with vault_ingest.

Frequently Asked Questions about vault

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I organize a persistent forensic knowledge base for threat actors and IOCs?

You can organize a persistent forensic knowledge base by scaffolding a structured vault that collects threat actors, IOCs, TTPs, cases, and findings. This approach enforces YAML frontmatter and an append-only log to maintain a living investigative repository.

What is the best way to structure long-term cyber investigations and threat findings?

The best way to structure long-term investigations is using a wiki structure with hot cache and memory tools. This scaffolding links findings to cases and entities for rapid retrieval, making complex investigations repeatable and searchable.

How do I ingest and query threat intelligence data in an Obsidian vault?

You ingest and query threat intelligence data using modular sub-skills like vault-ingest and vault-query. These tools support ongoing investigative workflows by enabling data ingestion and search within the structured wiki repository.

Does the vault knowledge base support quality checks for forensic notes?

Yes, the vault knowledge base supports quality checks through the vault-lint sub-skill. It enforces YAML frontmatter in notes and performs linting to ensure your forensic repository maintains strict structural integrity.

Can I use canvas boards to map TTPs and cases during an investigation?

Yes, you can use canvas boards to map TTPs and cases. The knowledge base supports canvas boards alongside an append-only log and structured wiki to visually maintain and scaffold ongoing investigative workflows.

Why does my forensic knowledge base require YAML frontmatter and an append-only log?

Your forensic knowledge base requires YAML frontmatter and an append-only log to enforce structure and maintain data integrity. These constraints ensure investigative findings remain organized, searchable, and persistently linked to their parent cases.