zettelforge
Enables security teams to build persistent, interconnected threat intelligence without manual documentation overhead.
An agentic memory system for cyber threat intelligence. It extracts CVEs, threat actors, IOCs, and MITRE ATT&CK techniques from analyst notes and threat reports, resolves actor aliases (APT28 = Fancy Bear = STRONTIUM = Sofacy), and builds a STIX 2.1 knowledge graph with causal relationships. Runs entirely in-process with no external API or cloud dependency, and serves past investigations back to analysts and to Claude Code via an MCP server.
- Link new malware samples to known threat actor campaigns
- Cross-reference IOCs across multiple concurrent incidents
- Build and query threat actor profile timelines
Enables security teams to build persistent, interconnected threat intelligence without manual documentation overhead. Reduces analyst context-switching and improves institutional knowledge retention across incident response cycles.
Security operations centers and threat intelligence teams managing multi-vector attack investigations and knowledge continuity.
https://github.com/ThreatRecall/zettelforge
By rolandpg
How to Get It
pip install zettelforge
Tip: Paste this into a Claude Code conversation. Verify command matches your Claude Code version.
After installing, paste this into Claude:
Help me link new malware samples to known threat actor campaigns
Trust Signals Auto-scanned
Community Pulse Active
Discussed on Hacker News, Reddit
- zettelforge: Agentic memory for CTI: STIX knowledge graphs, threat actor alias r — Reddit · 12 pts
- Introducing the Opensource Zettelforge project for CTI analysts — Reddit · 5 pts
- ZettelForge - Agentic Memory System for Cyber Threat Intelligence — Reddit · 5 pts
3 mentions across 1 sources
Reviewer notes
Auto-scanned review. These are observations, not a security certification.
Auto-assessment from April sweep — baseline scores pending hands-on review.
2026-04-18: Approved in April sweep: New and small but has a clear description and recent commits — worth tracking.
Things to check
- Requires careful data hygiene and deduplication logic to avoid polluting the knowledge base with conflicting intelligence. Effectiveness depends on consistent tagging and classification discipline across the team.
How to evaluate tools before deploying →
Data shown here comes from public APIs and automated scanning. Reviewer notes reflect one person's experience. This is not a security certification or legal recommendation. Always evaluate tools according to your own organization's policies.