ZettelForge v2.0.0: Agentic Memory System

Production-grade memory for CTI analysis. Hybrid TypeDB (STIX 2.1) + LanceDB (vectors). Zero external AI dependencies.

Status (2026-04-10)

All systems operational:

• ✅ Vector retrieval (fastembed, in-memory cosine similarity)
• ✅ Knowledge graph (TypeDB STIX 2.1 with JSONL fallback)
• ✅ Entity extraction (10 types: CVE, actor, tool, campaign, person, location, org, event, activity, temporal)
• ✅ Two-phase extraction pipeline (FactExtractor → MemoryUpdater)
• ✅ Cross-encoder reranking (ms-marco-MiniLM)
• ✅ Synthesis layer (direct_answer, synthesized_brief, timeline_analysis, relationship_map)
• ✅ 36 CTI aliases seeded (APT28/Fancy Bear/Strontium, etc.)

Benchmarks

Quick Start

from zettelforge import MemoryManager

mm = MemoryManager()

# Store threat intel
note, status = mm.remember(
    "APT28 uses Cobalt Strike for lateral movement via CVE-2024-1111",
    domain="cti"
)

# Two-phase extraction (selective, deduplicating)
results = mm.remember_with_extraction(
    "APT28 dropped DROPBEAR, now exploits edge devices.",
    domain="cti"
)

# Ingest reports (auto-chunks)
results = mm.remember_report(
    content="Full threat report text...",
    source_url="https://example.com/report",
    domain="cti"
)

# Retrieve — blended vector + graph, cross-encoder reranked
results = mm.recall("What tools does APT28 use?", k=10)

# Alias resolution works automatically
results = mm.recall_actor("Fancy Bear")  # resolves to APT28

# Entity lookups
mm.recall_cve("CVE-2024-3094")
mm.recall_tool("cobalt-strike")

# Graph traversal
paths = mm.traverse_graph("actor", "apt28", max_depth=2)

# Synthesize answers
result = mm.synthesize("Summarize APT28 activity", format="synthesized_brief")

Architecture

Agent → MemoryManager
  ├─ NoteConstructor → EntityExtractor (10 types, regex + optional LLM NER)
  ├─ FactExtractor → MemoryUpdater (ADD/UPDATE/DELETE/NOOP)
  ├─ TypeDB (STIX 2.1: 9 entity types, 8 relation types, inference)
  │   └─ JSONL fallback if TypeDB unavailable
  ├─ LanceDB (768-dim fastembed vectors, IVF_PQ index)
  │   └─ In-memory cosine similarity fallback
  ├─ BlendedRetriever (vector + graph, intent-weighted)
  ├─ Cross-encoder reranker (ms-marco-MiniLM, 80MB)
  ├─ Entity-augmented recall (entity index supplements vector results)
  ├─ Temporal boost (date extraction for temporal queries)
  └─ SynthesisGenerator (RAG, 4 output formats)

Retrieval Pipeline

Query → IntentClassifier (factual/temporal/relational/causal/exploratory)
  → VectorRetriever (cosine similarity + entity boost)
  → GraphRetriever (BFS from query entities, hop-distance scoring)
  → BlendedRetriever (policy-weighted merge)
  → Entity-augmented recall (entity index supplements)
  → Temporal boost (for temporal queries)
  → Cross-encoder reranking (ms-marco-MiniLM)
  → List[MemoryNote]

Configuration

# config.yaml
embedding:
  provider: fastembed           # or "ollama"
  model: nomic-ai/nomic-embed-text-v1.5-Q
llm:
  provider: local               # or "ollama"
  model: Qwen/Qwen2.5-3B-Instruct-GGUF
typedb:
  host: localhost
  port: 1729
backend: typedb                  # or "jsonl"

Environment variables:

ZETTELFORGE_BACKEND=jsonl                    # Skip TypeDB
ZETTELFORGE_EMBEDDING_PROVIDER=ollama        # Use Ollama for embeddings
ZETTELFORGE_LLM_PROVIDER=ollama              # Use Ollama for LLM

API Reference

STIX 2.1 Entity Types

threat-actor, malware, tool, attack-pattern, vulnerability, campaign, indicator, infrastructure, zettel-note (bridge to LanceDB)

STIX Relationship Types

uses, targets, attributed-to, indicates, mitigates, mentioned-in, supersedes, alias-of

Dependencies (zero external servers for AI)

License

MIT