vault-ingest

Forensic source ingestion involves loading files or URLs into the CyberSecSuite vault to semantically index artifacts. The process extracts actionable intelligence, including entities, IOCs, and TTPs, then automatically generates and updates linked wiki pages. It uses delta-tracking to skip unchanged sources and maintain indices efficiently.

Yes, you can ingest both URLs and local files without duplicating data because the skill uses delta-tracked ingestion. It automatically identifies and skips unchanged sources during the ingestion process. This ensures that subsequent scans only process new or modified forensic artifacts, keeping indices updated efficiently.

To build a wiki from ingested forensic artifacts, specify the file path or URL for ingestion. The skill extracts entities, IOCs, and TTPs from the sources, then automatically creates and updates wiki pages with linked references. It also performs housekeeping on indices and hot caches to maintain vault searchability.

Yes, vault ingest relies on the vault_ingest and vault_status MCP tools to orchestrate the extraction process. These tools manage the ingestion of local files and URLs, coordinate the extraction of entities, IOCs, and TTPs, and handle wiki maintenance. No additional dependencies are required beyond this MCP tool integration.

Delta-tracked ingestion is a mechanism that identifies and skips unchanged forensic sources when ingesting files or URLs into the vault. By comparing source states, it ensures only new or modified data is processed for entity, IOC, and TTP extraction. This optimizes performance and maintains updated indices without redundant processing.