zettelforge

Store and recall threat intelligence memories across investigations.

58|8|Updated Apr 6, 2026

Search Tags:#memory #graph #vector-search #threat-intelligence #entity-extraction #cti

Ready to run

npx skills add https://github.com/rolandpg/zettelforge --skill zettelforge

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: zettelforge
Source: https://github.com/rolandpg/zettelforge/tree/main/docs/archive
Command: npx skills add https://github.com/rolandpg/zettelforge --skill zettelforge

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

ZettelForge addresses the challenge of maintaining continuity in threat investigations by providing a persistent, queryable memory system that captures, stores, and recalls threat intelligence, actor aliases, IOCs, and ATT&CK mappings across investigations.

Core Features & Use Cases

Hybrid TypeDB (STIX 2.1 ontology) integrated with LanceDB vector search for fast retrieval and relational reasoning.
Zero external AI dependencies enabling on-host operation for secure investigations.
Entity extraction, memory graph traversal, and multi-hop recall for incident response and threat intel analysis.
Synthesis, cross-entity recall, and threat timeline construction for concise reporting.

Quick Start

To begin, ingest threat intel and surface relevant IOCs and actors.

Frequently Asked Questions about zettelforge

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I store and recall threat intelligence memories across multiple investigations?▼

You can store and recall threat intelligence memories by ingesting CVEs, IOCs, actors, and ATT&CK techniques into a persistent memory graph that supports vector search and multi-hop traversal for cross-investigation continuity.

Does threat intelligence memory require external AI dependencies for on-host operation?▼

No, threat intelligence memory can operate on-host with zero external AI dependencies. The extraction, indexing, vector search, and synthesis pipeline runs locally, ensuring secure investigations without external service calls.

How does knowledge graph traversal work for incident response and threat intel analysis?▼

Knowledge graph traversal for threat intel analysis maps STIX 2.1 ontology relationships, enabling multi-hop recall across actors, IOCs, and ATT&CK techniques to surface relational reasoning during incident response.

Can I use vector search and STIX 2.1 ontology together for threat actor and IOC retrieval?▼

Yes, you can use vector search alongside a STIX 2.1 ontology graph to retrieve threat actors and IOCs. This hybrid approach combines fast vector similarity retrieval with relational graph reasoning for comprehensive threat recall.

What is the best way to construct a threat timeline from ingested IOCs and ATT&CK mappings?▼

Constructing a threat timeline involves synthesizing cross-entity recall from ingested IOCs and ATT&CK mappings. The synthesis pipeline correlates entities and temporal data to generate concise threat reporting.

Are there limitations when using on-host threat intelligence memory for large-scale IOC ingestion?▼

On-host threat intelligence memory is optimized for secure, local investigations but may face scale limitations during high-volume IOC ingestion. Resource constraints on a single host can impact vector search indexing and graph traversal performance.