Store and recall threat intelligence memories across investigations.
npx skills add https://github.com/rolandpg/zettelforge --skill zettelforge
Please help me install this Agent Skill. Skill: zettelforge Source: https://github.com/rolandpg/zettelforge/tree/main/docs/archive Command: npx skills add https://github.com/rolandpg/zettelforge --skill zettelforge
ZettelForge addresses the challenge of maintaining continuity in threat investigations by providing a persistent, queryable memory system that captures, stores, and recalls threat intelligence, actor aliases, IOCs, and ATT&CK mappings across investigations.
To begin, ingest threat intel and surface relevant IOCs and actors.
High-intent search queries and answers about installing and using this skill.
You can store and recall threat intelligence memories by ingesting CVEs, IOCs, actors, and ATT&CK techniques into a persistent memory graph that supports vector search and multi-hop traversal for cross-investigation continuity.
No, threat intelligence memory can operate on-host with zero external AI dependencies. The extraction, indexing, vector search, and synthesis pipeline runs locally, ensuring secure investigations without external service calls.
Knowledge graph traversal for threat intel analysis maps STIX 2.1 ontology relationships, enabling multi-hop recall across actors, IOCs, and ATT&CK techniques to surface relational reasoning during incident response.
Yes, you can use vector search alongside a STIX 2.1 ontology graph to retrieve threat actors and IOCs. This hybrid approach combines fast vector similarity retrieval with relational graph reasoning for comprehensive threat recall.
Constructing a threat timeline involves synthesizing cross-entity recall from ingested IOCs and ATT&CK mappings. The synthesis pipeline correlates entities and temporal data to generate concise threat reporting.
On-host threat intelligence memory is optimized for secure, local investigations but may face scale limitations during high-volume IOC ingestion. Resource constraints on a single host can impact vector search indexing and graph traversal performance.
ddttomConvert Markdown blog drafts into semantic, WCAG 2.1 AA compliant HTML with extracted SVGs and metadata.
EojEdredMonitor validators and analyze SSH logs for security threats.
robit-manApplies Sigma detection rules to logs and converts them to Elasticsearch, Splunk, and grep queries.
voidrotTune HNSW parameters and apply quantization to optimize vector index performance.
