Terminology reference¶

This page is the single source of truth for product names, API identifiers, and entity type vocabulary used across ZettelForge documentation. When in doubt, prefer the forms listed here over informal variations.

Prerequisites: None. This page describes the public names and identifiers in ZettelForge 2.8.0 and the canonical name of the hosted ThreatRecall.ai product.

Product names¶

Term	Use	Avoid
ZettelForge	The open-source CTI memory engine. Always one word, always capitalized.	"Zettelforge", "zettelforge", "ZF" in prose
ThreatRecall.ai	The hosted SaaS product. One word, capital T and R, with lowercase `ai` after the dot.	"ThreatRecall", "Threat Recall", "threatrecall" in prose
ZettelForge OSS	Acceptable short form when distinguishing from SaaS in the same sentence.	"ZettelForge open source" after the first mention

ThreatRecall.ai is the commercial hosted product. ZettelForge is the MIT-licensed open-source engine. They share a core but are distinct products; do not use the names interchangeably.

Core API classes¶

Term	Description
`MemoryManager`	The main Python class. PascalCase, two words joined.
`MemoryNote`	The data model for a stored memory. PascalCase.
`get_memory_manager()`	Process-wide singleton factory function. snake_case.

API methods¶

Use the exact method names from source; do not shorten or paraphrase them in code examples or inline code spans.

Method	Description
`remember()`	Store one note.
`remember_chunked()`	Split and store a long text as multiple notes.
`remember_with_extraction()`	Two-phase LLM extraction into notes.
`remember_report()`	Ingest a news or threat report with chunking and extraction.
`recall()`	Retrieve notes by blended vector and graph retrieval.
`recall_actor()`	Entity-index lookup by actor name.
`recall_cve()`	Entity-index lookup by CVE ID.
`recall_tool()`	Entity-index lookup by tool name.
`recall_technique()`	Entity-index lookup by ATT&CK technique ID.
`recall_entity()`	Entity-index lookup by type and value.
`synthesize()`	Retrieval-augmented answer generation.
`ingest_relationship()`	Write a knowledge graph edge directly.
`traverse_graph()`	Walk relationship paths outward from an entity.
`get_entity_relationships()`	Return direct knowledge graph neighbors of an entity.
`get_context()`	Return a formatted context string for agent prompts.
`flush()`	Block until background enrichment jobs complete.
`snapshot()`	Export a JSONL snapshot of memory.

Entity types¶

These strings are the canonical values used in recall_entity(), ingest_relationship(), and the entity index. Spell them exactly as shown.

CTI and IOC types (regex-extracted, no LLM required)¶

Entity type	Example
`cve`	`CVE-2024-1234`
`intrusion_set`	`APT28`, `UNC4990`, `FIN7`
`actor`	`Lazarus`, `Sandworm`, `Volt Typhoon`
`tool`	`Cobalt Strike`, `Mimikatz`, `BloodHound`
`campaign`	`Operation Aurora`
`attack_pattern`	`T1059`, `T1059.001`
`ipv4`	IPv4 address
`domain`	Registered domain
`url`	HTTP/HTTPS URL
`md5`	32-character hex hash
`sha1`	40-character hex hash
`sha256`	64-character hex hash
`email`	Email address

Conversational types (LLM NER, requires a configured LLM provider)¶

Entity type	Description
`person`	Named person in non-threat-actor context
`location`	Place name
`organization`	Named organization
`event`	Named event
`activity`	Described activity
`temporal`	Time expression

Lookup aliases¶

recall_actor() searches actor, threat_actor, and intrusion_set in one call. The actor and threat_actor types are interchangeable for lookup but intrusion_set is preferred for APT/UNC/FIN-style designations.

Knowledge graph relationship types¶

ZettelForge 2.8.0 writes these built-in relationship labels and returns them from get_entity_relationships() and traverse_graph(). You can also pass them to ingest_relationship(). See the KG Edge Schema reference for the complete taxonomy.

CTI and IOC relationship types¶

Relationship	Meaning
`MENTIONED_IN`	Entity appears in a note
`USES_TOOL`	Actor or campaign uses a tool
`EXPLOITS_CVE`	Actor or tool exploits a CVE
`TARGETS_ASSET`	Actor or tool targets an asset
`CONDUCTS_CAMPAIGN`	Actor conducts a campaign
`USES_TECHNIQUE`	Actor uses an ATT&CK technique
`IMPLEMENTS`	Malware implements an ATT&CK technique

Temporal and note-lifecycle relationship types¶

Relationship	Meaning
`SUPERSEDES`	Note supersedes another note

Conversational relationship types¶

These are written by the LLM enrichment path and require a configured LLM provider.

Relationship	Meaning
`AFFILIATED_WITH`	Person affiliated with an organization
`ATTENDED`	Person attended an event
`LOCATED_AT`	Person or organization at a location
`PARTICIPATES_IN`	Person participates in an activity
`HELD_AT`	Event held at a location
`ORGANIZED_BY`	Event organized by an organization
`OCCURRED_ON`	Event occurred at a temporal point
`BASED_IN`	Organization based in a location

Epistemic tier values¶

The tier field on MemoryNote.metadata uses single uppercase letters.

Value	Meaning
`A`	Authoritative — from a primary, verified source
`B`	Operational — derived, processed, or synthesized
`C`	Support — background, context, or low-confidence

TLP values¶

In ZettelForge 2.8.0, MemoryNote.metadata.tlp is a free-form string with an empty-string default. The shipped schema documents the following values, and the SQLite backend stores the string without normalizing it:

Value	Role in ZettelForge 2.8.0
`""` (empty string)	Schema and SQLite default
`WHITE`	Documented schema value; not validated
`GREEN`	Documented schema value; not validated
`AMBER`	Documented schema value; not validated
`RED`	Documented schema value; not validated

TLP policy enforcement is in progress

ZettelForge 2.8.0 does not validate, rank, or enforce TLP values. Use the labels above consistently, but enforce sharing policy outside ZettelForge until a public policy layer ships.

Architecture terms¶

Term	Use
knowledge graph	The entity relationship store. Two words, no hyphen in prose.
background worker	The thread that drains the enrichment queue. Not "agent".
enrichment	LLM-driven causal extraction, NER, and note evolution. Not "processing".
blended retrieval	Combined vector similarity plus graph traversal. Not "hybrid retrieval".
fast path	The write path that returns before LLM enrichment completes.
two-phase extraction	Phase 1 (score facts) plus Phase 2 (decide ADD/UPDATE/NOOP). Hyphenated as a compound modifier.
backend	Storage backend (SQLite or TypeDB). Lowercase in prose; `SQLiteBackend` as a class name.

Storage backends¶

Term	Use
`sqlite`	The default backend. Lowercase in config values; "SQLite" in prose.
`typedb`	The TypeDB 3.x backend. Lowercase in config values; "TypeDB" in prose.

Synthesis format values¶

format argument to synthesize() and POST /api/synthesize.

Value	Availability
`direct_answer`	Available in ZettelForge 2.8.0
`synthesized_brief`	In progress. ZettelForge 2.8.0 accepts the value but falls back to `direct_answer`; the current ThreatRecall.ai endpoint uses `brief` or `detailed` instead.
`timeline_analysis`	In progress. ZettelForge 2.8.0 accepts the value but falls back to `direct_answer`; the current ThreatRecall.ai endpoint uses `brief` or `detailed` instead.
`relationship_map`	In progress. ZettelForge 2.8.0 accepts the value but falls back to `direct_answer`; the current ThreatRecall.ai endpoint uses `brief` or `detailed` instead.