** 사이버 위협 인텔리전스에 내장 된 유일한 에이전트 메모리 시스템. **

수석 분석가가가가 잎 때, 두 개 또는 3 년의 컨텍스트가 그들과 함께 걸린다 — 고객 환경, 사전 조사, 배우 TTP, 거짓 적합 패턴, 모든 hard-won “wait, we’ve see this before.” ZettelForge는 팀과 컨텍스트가 유지되도록 제작된 에이전트 메모리 시스템입니다.

CVEs, 위협 배우, IOCs 및 ATT&CK 기술을 분석적인 노트와 위협 보고서에서 추출하고, aliases (APT28 = Fancy Bear = STRONTIUM = sofacy)를 해결하고, STIX 2.1 지식 그래프를 구축하고, MCP를 통한 Claude Code로 돌아가서 모든 과거 조사를 지원합니다. 전반적으로 프로세스를 실행합니다. API 키가 없습니다. 구름 없음. 데이터가 호스트를 나타낸다.

Star · pip install zettelforge · Docs · ThreatRecall (hosted) · Changelog

** v2.6.2** (2026-04-27): 모든 enum 필드 (LLM/embedding 제공 업체, 로그 레벨, PII 액션, 합성 형식) 및 작업 적용 버튼을 위해 작업 드롭다운을 가진 Config 웹 편집기 배. 새로운 [crewai] 추가 노출 ZettelForge로 CrewAI 도구 – pip install zettelforge[crewai]. 전체 changelog

ZettelForge

The only agentic memory system built for cyber threat intelligence.

When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won “wait, we’ve seen this before.” ZettelForge is an agentic memory system built so that context stays with the team.

It extracts CVEs, threat actors, IOCs, and ATT&CK techniques from analyst notes and threat reports, resolves aliases (APT28 = Fancy Bear = STRONTIUM = Sofacy), builds a STIX 2.1 knowledge graph, and serves every past investigation back to your analysts — and to Claude Code via MCP — in natural language. Runs entirely in-process. No API keys. No cloud. No data leaves the host.

Star · pip install zettelforge · Docs · ThreatRecall (hosted) · Changelog

v2.6.2 (2026-04-27): Config web editor ships with working dropdowns for all enum fields (LLM/embedding provider, log level, PII action, synthesis format) and a working Apply button. New [crewai] extra exposes ZettelForge as CrewAI tools – pip install zettelforge[crewai]. Full changelog

If ZettelForge fits a CTI workflow you run, a star is the fastest signal that this category is worth continuing to invest in.

The problem

Every SOC loses analysts. When they leave, investigation context, actor attribution, and environment-specific false-positive patterns go with them. Their replacements re-open the same tickets, re-read the same reports, and re-build the same mental models from scratch.