Live recall surface
Agentic Memory for CTI & OSINT teams.
Persistent, auditable recall across investigations — so your agents and analysts stop re-deriving what they already knew. Complements OpenCTI, MISP, and your SIEM. Doesn't replace them.
Queries run against a read-only workspace pre-loaded with
APT29, Volt Typhoon, and HAFNIUM
intelligence from public sources. TLP:WHITE / TLP:GREEN only.
Guided queries — click to run
Recall against your own IOCs
Paste indicators — pattern match only
Max 50 lines · up to 20 results · 10 qry/hr · TLP:CLEAR only
Paste a STIX 2.1 bundle
Ingest your own threat data → recall against it
Accepts any STIX 2.1 JSON bundle (SDOs + SROs).
Use a MITRE ATT&CK STIX sample →
Max 256 KB · 500 objects · 5 ingests/hr · TLP:AMBER/RED accepted but hidden in demo
Free-form query
Built for SOC, CTI, OSINT, and IR agents running on open-source agentic infrastructure.
10 queries / hour per IP. TLP:AMBER and TLP:RED indicators not permitted on this surface.
Give your agents memory that remembers between investigations.
Pilot access — 90-day design partner program.
Export this investigation
Signed JSON audit bundle + PDF report. Ed25519 verified. Shareable with your team.
This is the recall layer
Bring your own CTI. This is what it looks like with yours.
What you just ran against 39 public-source nodes works the same on your own ingested reports, STIX bundles, and analyst notes — with full TLP controls, evidence provenance, and write-once audit logs.
Apply for pilot → 30 days, no charge, you keep the data.