Zettelforge FAQs

Question 1

How does Zettelforge manage evolving threat intelligence?

Accepted Answer

Through 'Memory Evolution', Zettelforge uses an LLM to compare new intelligence with existing memory. It intelligently decides whether to ADD, UPDATE, DELETE, or NOOP, ensuring stale intel is superseded and contradictions are resolved.

Question 2

What key features does Zettelforge offer for CTI?

Accepted Answer

Zettelforge automatically extracts CTI entities (CVEs, IOCs, MITRE ATT&CK), builds knowledge graphs with causal triples, resolves threat actor aliases (e.g., APT28 = Fancy Bear), and enables 'Memory Evolution' for intelligent updates and conflict resolution.

Question 3

Can Zettelforge operate without an internet connection or cloud services?

Accepted Answer

Yes, Zettelforge is designed for offline-first operation. It uses local embeddings (fastembed) and supports local LLMs (via llama-cpp-python or Ollama), eliminating the need for cloud APIs or external services.

Question 4

How can I integrate Zettelforge with my AI agents?

Accepted Answer

Zettelforge can be integrated as a memory backend for AI agents, including Claude Code via its MCP server. This allows agents to use Zettelforge's exposed tools for remembering, recalling, and synthesizing threat intelligence across sessions.

Question 5

What is Zettelforge?

Accepted Answer

Zettelforge is the only agentic memory system built specifically for cyber threat intelligence (CTI). It provides AI agents with persistent, intelligent memory capabilities, leveraging entity extraction, knowledge graphs, and STIX ontology.

Zettelforge

Zettelforge

主な機能

ユースケース

主な機能

ユースケース