Terminology reference¶

This page is the single source of truth for product names, API identifiers, and entity type vocabulary used across ZettelForge documentation. When in doubt, prefer the forms listed here over informal variations.

Product names¶

Term	Use	Avoid
ZettelForge	The open-source CTI memory engine. Always one word, always capitalized.	"Zettelforge", "zettelforge", "ZF" in prose
ThreatRecall.ai	The hosted SaaS product. Always hyphenated, lowercase "ai".	"ThreatRecall", "Threat Recall", "threatrecall" in prose
ZettelForge OSS	Acceptable short form when distinguishing from SaaS in the same sentence.	"ZettelForge open source" (only at first mention) is also acceptable

ThreatRecall.ai is the commercial hosted product. ZettelForge is the Apache-2.0-licensed open-source engine. They share a core but are distinct products; do not use the names interchangeably.

Core API classes¶

Term	Description
`MemoryManager`	The main Python class. PascalCase, two words joined.
`MemoryNote`	The data model for a stored memory. PascalCase.
`get_memory_manager()`	Process-wide singleton factory function. snake_case.

API methods¶

Use the exact method names from source; do not shorten or paraphrase them in code examples or inline code spans.

Method	Description
`remember()`	Store one note.
`remember_chunked()`	Split and store a long text as multiple notes.
`remember_with_extraction()`	Two-phase LLM extraction into notes.
`remember_report()`	Ingest a news or threat report with chunking and extraction.
`recall()`	Retrieve notes by blended vector and graph retrieval.
`recall_actor()`	Entity-index lookup by actor name.
`recall_cve()`	Entity-index lookup by CVE ID.
`recall_tool()`	Entity-index lookup by tool name.
`recall_technique()`	Entity-index lookup by ATT&CK technique ID.
`recall_entity()`	Entity-index lookup by type and value.
`synthesize()`	Retrieval-augmented answer generation.
`ingest_relationship()`	Write a knowledge graph edge directly.
`traverse_graph()`	Walk relationship paths outward from an entity.
`get_entity_relationships()`	Return direct knowledge graph neighbors of an entity.
`get_context()`	Return a formatted context string for agent prompts.
`flush()`	Block until background enrichment jobs complete.
`snapshot()`	Export a JSONL snapshot of memory.

Entity types¶

These strings are the canonical values used in recall_entity(), ingest_relationship(), and the entity index. Spell them exactly as shown.

CTI and IOC types (regex-extracted, no LLM required)¶

Entity type	Example
`cve`	`CVE-2024-1234`
`intrusion_set`	`APT28`, `UNC4990`, `FIN7`
`actor`	`Lazarus`, `Sandworm`, `Volt Typhoon`
`tool`	`Cobalt Strike`, `Mimikatz`, `BloodHound`
`campaign`	`Operation Aurora`
`attack_pattern`	`T1059`, `T1059.001`
`ipv4`	IPv4 address
`domain`	Registered domain
`url`	HTTP/HTTPS URL
`md5`	32-character hex hash
`sha1`	40-character hex hash
`sha256`	64-character hex hash
`email`	Email address

Conversational types (LLM NER, requires a configured LLM provider)¶

Entity type	Description
`person`	Named person in non-threat-actor context
`location`	Place name
`organization`	Named organization
`event`	Named event
`activity`	Described activity
`temporal`	Time expression

Lookup aliases¶

recall_actor() searches actor, threat_actor, and intrusion_set in one call. The actor and threat_actor types are interchangeable for lookup but intrusion_set is preferred for APT/UNC/FIN-style designations.

Knowledge graph relationship types¶

Canonical relationship label strings used in ingest_relationship() and returned by get_entity_relationships() and traverse_graph(). See the KG Edge Schema reference for the complete taxonomy.

CTI and IOC relationship types¶

Relationship	Meaning
`MENTIONED_IN`	Entity appears in a note
`USES_TOOL`	Actor or campaign uses a tool
`EXPLOITS_CVE`	Actor or tool exploits a CVE
`TARGETS_ASSET`	Actor or tool targets an asset
`CONDUCTS_CAMPAIGN`	Actor conducts a campaign
`USES_TECHNIQUE`	Actor uses an ATT&CK technique
`IMPLEMENTS`	Malware implements an ATT&CK technique

Temporal and note-lifecycle relationship types¶

Relationship	Meaning
`SUPERSEDES`	Note supersedes another note
`TEMPORAL_BEFORE`	Note precedes another temporally
`TEMPORAL_AFTER`	Note follows another temporally

Conversational relationship types¶

These are written by the LLM enrichment path and require a configured LLM provider.

Relationship	Meaning
`AFFILIATED_WITH`	Person affiliated with an organization
`ATTENDED`	Person attended an event
`LOCATED_AT`	Person or organization at a location
`PARTICIPATES_IN`	Person participates in an activity
`HELD_AT`	Event held at a location
`ORGANIZED_BY`	Event organized by an organization
`OCCURRED_ON`	Event occurred at a temporal point
`BASED_IN`	Organization based in a location

Epistemic tier values¶

The tier field on MemoryNote.metadata uses single uppercase letters.

Value	Meaning
`A`	Authoritative — from a primary, verified source
`B`	Operational — derived, processed, or synthesized
`C`	Support — background, context, or low-confidence

TLP values¶

Traffic Light Protocol markings on MemoryNote.metadata.tlp. Both short forms (WHITE) and TLP:-prefixed forms (TLP:WHITE) are accepted; the policy layer normalizes them when making sharing decisions. The field stores whatever value was passed at ingest time.

Value	Rank	Meaning
`""` (empty string)	—	Unclassified; normalized to `TLP:CLEAR` by the policy
`CLEAR` or `TLP:CLEAR`	0	Unlimited distribution
`WHITE` or `TLP:WHITE`	0	Unlimited distribution (same sharing level as CLEAR)
`GREEN` or `TLP:GREEN`	1	Community-limited distribution
`AMBER` or `TLP:AMBER`	2	Organization-limited distribution
`AMBER+STRICT` or `TLP:AMBER+STRICT`	3	Organization-limited, no further sharing
`RED` or `TLP:RED`	4	Named recipients only

The default note TLP is TLP:CLEAR. The default share-max TLP (for unauthenticated export) is TLP:GREEN. TLP:AMBER and higher require an explicit caller identity matching the configured local identity.

Architecture terms¶

Term	Use
knowledge graph	The entity relationship store. Two words, no hyphen in prose.
background worker	The thread that drains the enrichment queue. Not "agent".
enrichment	LLM-driven causal extraction, NER, and note evolution. Not "processing".
blended retrieval	Combined vector similarity plus graph traversal. Not "hybrid retrieval".
fast path	The write path that returns before LLM enrichment completes.
two-phase extraction	Phase 1 (score facts) plus Phase 2 (decide ADD/UPDATE/NOOP). Hyphenated as a compound modifier.
backend	Storage backend (SQLite or TypeDB). Lowercase in prose; `SQLiteBackend` as a class name.

Storage backends¶

Term	Use
`sqlite`	The default backend. Lowercase in config values; "SQLite" in prose.
`typedb`	The TypeDB 3.x backend. Lowercase in config values; "TypeDB" in prose.

Synthesis format values¶

format argument to synthesize() and POST /api/synthesize.

Value	Availability
`direct_answer`	ZettelForge OSS and ThreatRecall.ai
`synthesized_brief`	ThreatRecall.ai SaaS only; falls back to `direct_answer` in OSS
`timeline_analysis`	ThreatRecall.ai SaaS only; falls back to `direct_answer` in OSS
`relationship_map`	ThreatRecall.ai SaaS only; falls back to `direct_answer` in OSS