CTI Memory for SOC Teams

Persistent memory for security operations

ThreatRecall is a tenant-isolated knowledge graph for cyber threat intelligence. Natural language recall, STIX 2.1 export, structured ingest pipeline, and a REST API that integrates with any agent framework. Built on Azure App Service with PostgreSQL backing.

Stack: Node.js, PostgreSQL, Azure

Standards: STIX 2.1, MITRE ATT&CK, CWE/CVE

Status: Production pilot

Platform architecture

Component	Description
Knowledge Graph	PostgreSQL-backed graph with tenant-isolated schemas. Nodes represent actors, campaigns, TTPs, CVEs, IOCs, evidence records. Edges represent relationships (uses, targets, exploits, mitigates) with confidence scores.
Recall Engine	Natural language search across the graph. Resolves entity references, traverses relationships, returns ranked results. Powers agent integration and dashboard queries.
Ingest Pipeline	LLM-assisted extraction from raw text (reports, advisories, blog posts). Structured entities flow into staging for analyst review before commit. Evidence records maintain provenance chains.
STIX 2.1 Export	Export any recall session as a STIX 2.1 bundle. Compatible with OpenCTI, MISP, and any STIX-compliant platform. Includes full relationship mapping.
Tenant Isolation	Defense-in-depth: sentinel UUID per tenant, `SET LOCAL` at connection level, app-layer WHERE clause enforcement. Each workspace is an opaque security boundary.
Audit Trail	Write-once audit log. Every create, update, and delete is recorded with actor, timestamp, and operation type. Immutable by design.

Deployment

ThreatRecall runs on Azure App Service with PostgreSQL Flexible Server. Infrastructure is defined as code (Bicep) with GitHub OIDC for CI/CD. Cloudflare DNS routes threatrecall.ai. Application Insights and Log Analytics provide observability.

Stack

Compute:  Azure App Service (Linux, Node.js 20)
Database:  PostgreSQL Flexible Server
Secrets:   Azure Key Vault
CDN/Edge:  Cloudflare DNS + R2 (static assets)
Registry:  Azure Container Registry
CI/CD:     GitHub Actions + OIDC
Telemetry: App Insights + Log Analytics

Agent integration paths

Connect any agent framework to ThreatRecall memory. Choose your integration below.

MCP

Model Context Protocol

Works with Claude Code, Cursor, Goose, any MCP client.

Install a small npm package and point your agent at ThreatRecall. One config file, no code.

⏱ ~5 min ● Claude Code, Cursor, Goose users

View guide →

LangChain

LangChain Adapter

Drop-in MemoryRetriever for LangChain pipelines.

Install the adapter, drop in the retriever, wire your workspace. Works with CrewAI.

⏱ ~10 min ● LangChain Python/JS, CrewAI users

View guide →

CrewAI

CrewAI Memory

Give your analyst agents persistent recall.

Wire ThreatRecall as memory for CrewAI agents. Define a task, let the agent query it.

⏱ ~10 min ● CrewAI platform users

View guide →

REST

REST API

Works with every language and platform.

Get your key, make a curl call. Full endpoint reference, every request/response example.

⏱ ~3 min ● Any developer or platform

View guide →

Sidecar

FastAPI Sidecar

Natural language CTI queries from Python agents.

Docker Compose one-liner. Connect via HTTP, resolve aliases, traverse relationships.

⏱ ~10 min ● Python agents, custom runtimes

View guide →

API reference

Method	Endpoint	Description
GET	`/api/recall/search?query=...`	Natural language search across the knowledge graph
POST	`/api/graph/nodes`	Create entities (actors, CVEs, IOCs, TTPs, campaigns)
GET	`/api/graph`	Retrieve full graph or subgraph
POST	`/api/graph/edges`	Create relationships between nodes with confidence scoring
POST	`/api/ingest`	Submit raw text for LLM extraction into structured entities
GET	`/api/recall/sessions/:id/export.stix`	Export a recall session as STIX 2.1 bundle
GET	`/api/audit/logs`	Query the immutable audit log
GET	`/health`	Health check (no auth required)

Full OpenAPI 3.1 spec at /docs/api or /openapi.json. Authentication via Bearer token. API keys generated per workspace.

Additional resources