Using ZettelForge as a persistent knowledge-graph layer for Level 2–4 hunts

[rolandpg]

The idea

I maintain ZettelForge, an open-source (MIT) memory system for AI agents built around CTI. It combines a TypeDB STIX 2.1 knowledge graph with LanceDB vector search to give agents persistent, entity-linked memory across sessions.

After spending time with ATHF I think the two projects are complementary, not competing — ATHF is the best workflow layer I've seen for structuring hunts, and ZettelForge is the best knowledge layer I've built for reasoning across them. I'd like to explore an integration.

What ZettelForge would add to ATHF hunts

Capability	ATHF today	With ZettelForge
Similarity search	scikit-learn TF-IDF	768-dim fastembed vectors + knowledge graph traversal
Entity resolution	None	36 threat-actor alias chains resolved at query time (APT28 = Fancy Bear = Strontium = Forest Blizzard)
Cross-hunt linking	related_hunts field (manual)	Automatic — entities extracted from LOCK sections are linked in a STIX 2.1 graph
IOC extraction	None	CVEs, IPs, domains, hashes extracted and indexed per hunt
Detection generation	None	Sigma YAML + Microsoft Sentinel KQL from extracted IOCs
Causal reasoning	None	Graph traversal: "which hunts involve tools used by APT29?"

Working demo: athf_bridge.py

I wrote a bridge script that ingests completed ATHF hunts into ZettelForge. It:

1. Parses YAML frontmatter + LOCK sections (mirrors athf.core.hunt_parser)
2. Stores each hunt as a ZettelForge memory note with CTI domain metadata
3. Extracts MITRE technique IDs → creates attack-pattern nodes in the graph
4. Extracts IOCs from CHECK/KEEP sections → creates indicator nodes
5. Wires edges: hunt → techniques, hunt → IOCs

# Ingest a single hunt
python athf_bridge.py /path/to/hunts/H-0042.md

# Ingest all hunts recursively
python athf_bridge.py /path/to/hunts/

# Dry-run — parse and print, don't ingest
python athf_bridge.py --dry-run /path/to/hunts/

After ingestion, ZettelForge queries work across your hunt library:

from zettelforge import get_memory_manager

mm = get_memory_manager()

# Semantic recall across all ingested hunts
results = mm.recall("lateral movement via RDP")

# Graph traversal: what techniques appear alongside T1059?
neighbors = mm.knowledge_graph.get_neighbors("attack-pattern", "T1059")

# Blended retrieval: vector similarity + graph context
from zettelforge import BlendedRetriever
retriever = BlendedRetriever(mm)
results = retriever.retrieve("APT28 credential harvesting", k=5)

Full script: athf_bridge.py

Where this fits in the maturity model

• Levels 0–1: ATHF alone is the right tool. No graph needed.
• Level 2 (Searchable): ZettelForge's vector + graph retrieval replaces TF-IDF with entity-aware search.
• Level 3 (Generative): ZettelForge's blended retriever feeds richer context into LLM-generated hypotheses.
• Level 4 (Agentic): The TypeDB graph enables causal queries that flat-file search can't answer — "show me all hunts where the actor used tools that exploit CVEs in our KEV list."

What I'm not proposing

This isn't a "replace your storage" pitch. ATHF's markdown-first design is a feature — hunts should be human-readable files in git. ZettelForge would sit alongside as a read-optimized index that makes those files searchable, linkable, and queryable in ways that grep and TF-IDF can't.

Next steps I'd like to discuss

1. Is the athf_bridge.py approach useful? Would ATHF users benefit from a persistent knowledge layer they can query across hunts?
2. Plugin integration: ATHF has a plugin system — would a zettelforge plugin that auto-indexes hunts on athf hunt new --complete be interesting?
3. MCP tool enrichment: ZettelForge could expose graph queries as additional MCP tools alongside ATHF's existing 17.

Happy to iterate on any of this. The bridge script is MIT-licensed and works against ATHF's current hunt format.

— Patrick (rolandpg)