zettelforge

What problem does it solve?

ZettelForge addresses the challenge of maintaining continuity in threat investigations by providing a persistent, queryable memory system that captures, stores, and recalls threat intelligence, actor aliases, IOCs, and ATT&CK mappings across investigations.

Core Features & Use Cases

• Hybrid TypeDB (STIX 2.1 ontology) integrated with LanceDB vector search for fast retrieval and relational reasoning.
• Zero external AI dependencies enabling on-host operation for secure investigations.
• Entity extraction, memory graph traversal, and multi-hop recall for incident response and threat intel analysis.
• Synthesis, cross-entity recall, and threat timeline construction for concise reporting.

Quick Start

To begin, ingest threat intel and surface relevant IOCs and actors.