zettelforge

ZettelForge v2.0.0: Agentic Memory System

Production-grade memory for CTI analysis. Hybrid TypeDB (STIX 2.1) + LanceDB (vectors). Zero external AI dependencies.

Status (2026-04-10)

All systems operational:

• ✅ Vector retrieval (fastembed, in-memory cosine similarity)
• ✅ Knowledge graph (TypeDB STIX 2.1 with JSONL fallback)
• ✅ Entity extraction (10 types: CVE, actor, tool, campaign, person, location, org, event, activity, temporal)
• ✅ Two-phase extraction pipeline (FactExtractor → MemoryUpdater)
• ✅ Cross-encoder reranking (ms-marco-MiniLM)
• ✅ Synthesis layer (direct_answer, synthesized_brief, timeline_analysis, relationship_map)
• ✅ 36 CTI aliases seeded (APT28/Fancy Bear/Strontium, etc.)

Benchmarks

Benchmark	Score	What it tests
CTI Retrieval	75.0%	Attribution, CVE linkage, tools, temporal, multi-hop
LOCOMO	18.0%	Conversational memory recall
RAGAS	78.1%	Retrieval quality (keyword presence)

Quick Start

from zettelforge import MemoryManager

mm = MemoryManager()

# Store threat intel
note, status = mm.remember(
    "APT28 uses Cobalt Strike for lateral movement via CVE-2024-1111",
    domain="cti"
)

# Two-phase extraction (selective, deduplicating)
results = mm.remember_with_extraction(
    "APT28 dropped DROPBEAR, now exploits edge devices.",
    domain="cti"
)

# Ingest reports (auto-chunks)
results = mm.remember_report(
    content="Full threat report text...",
    source_url="https://example.com/report",
    domain="cti"
)

# Retrieve — blended vector + graph, cross-encoder reranked
results = mm.recall("What tools does APT28 use?", k=10)

# Alias resolution works automatically
results = mm.recall_actor("Fancy Bear")  # resolves to APT28

# Entity lookups
mm.recall_cve("CVE-2024-3094")
mm.recall_tool("cobalt-strike")

# Graph traversal
paths = mm.traverse_graph("actor", "apt28", max_depth=2)

# Synthesize answers
result = mm.synthesize("Summarize APT28 activity", format="synthesized_brief")