唯一为网络威胁情报打造的智能记忆系统。

当高级分析师离开时，两三年的背景信息随之而来——客户环境、先前调查、行为者TTP、误报模式，以及每一个来之不易的“等等，我们以前见过这种情况”。ZettelForge是一个智能记忆系统，旨在让团队内的上下文保持在团队中。

它从分析师笔记和威胁报告中提取CVE、威胁行为者、IOC和ATT&CK技术，解析别名（APT28 = Fancy Bear = STRONTIUM = Sofacy），构建STIX 2.1知识图谱，并将所有过去的调查以自然语言反馈给分析师——以及通过MCP传递给Claude代码。完全在进程中运行。无API密钥。无云。无数据流出主机。

星辰 ·pip install zettelforge ·文档 ·威胁回忆（托管）·更新日志

v2.6.2（2026-04-27）：配置网页编辑器自带所有枚举字段（LLM/嵌入提供者、日志级别、个人信息操作、合成格式）的工作下拉菜单，以及一个可用的应用按钮。新的[crewai]额外内容将ZettelForge暴露为CrewAI工具——pip install zettelforge[crewai]。完整更新日志

ZettelForge

The only agentic memory system built for cyber threat intelligence.

When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won “wait, we’ve seen this before.” ZettelForge is an agentic memory system built so that context stays with the team.

It extracts CVEs, threat actors, IOCs, and ATT&CK techniques from analyst notes and threat reports, resolves aliases (APT28 = Fancy Bear = STRONTIUM = Sofacy), builds a STIX 2.1 knowledge graph, and serves every past investigation back to your analysts — and to Claude Code via MCP — in natural language. Runs entirely in-process. No API keys. No cloud. No data leaves the host.

Star · pip install zettelforge · Docs · ThreatRecall (hosted) · Changelog

v2.6.2 (2026-04-27): Config web editor ships with working dropdowns for all enum fields (LLM/embedding provider, log level, PII action, synthesis format) and a working Apply button. New [crewai] extra exposes ZettelForge as CrewAI tools – pip install zettelforge[crewai]. Full changelog

If ZettelForge fits a CTI workflow you run, a star is the fastest signal that this category is worth continuing to invest in.

The problem

Every SOC loses analysts. When they leave, investigation context, actor attribution, and environment-specific false-positive patterns go with them. Their replacements re-open the same tickets, re-read the same reports, and re-build the same mental models from scratch.