The operating system for threat recall. A persistent, queryable memory layer for AI agents, agentic SOC platforms, and the analysts who run them.
APT29 uses PowerShell remoting for lateral movement targeting Exchange servers. Linked to CVE-2024-1234. Observed across 3 MSSP client environments.
APT29 favors PowerShell remoting via scheduled tasks for lateral movement. Prefers targeting Exchange and AAD Connect servers. Recommend hunting T1059.001. Confidence: HIGH — 3 evidence chains.
Query completed. 2 investigations recalled, 1 knowledge graph branch retrieved. This session now carries APT29 context — no re-investigation needed.
Every AI agent session is a fresh start. LangChain, AutoGen, CrewAI — none of them persist what they learned across sessions. The same investigation gets re-done by the same agent, every time.
Years of threat intelligence — actor behaviors, victim profiles, infrastructure patterns — lives in analysts' heads, Slack threads, and personal notebooks. Turnover erases it all, permanently.
Existing threat intel platforms assume a human at a keyboard browsing dashboards. They weren't designed for agents to query, retrieve, and synthesize. You're left building one-off integrations that break on every API change.
ThreatRecall integrates with your agentic stack — not a human dashboard bolted onto an API.
Agents POST structured threat observations via REST. ThreatRecall extracts entities, resolves aliases, and links to the knowledge graph automatically — no manual tagging.
Every write feeds the graph. Actor relationships, campaign attribution, IOC infrastructure chains — all connected. Multi-tenant isolation means MSSPs can serve N clients with completely separate memory stores.
Natural language recall. Vector + keyword + structured routing. Agents and analysts both query the same memory layer — same trust, same recall quality.
LangChain adapter shipped. MCP server planned. OpenCTI, CrewAI, AutoGen on the roadmap. Your agentic platform — ThreatRecall memory layer underneath.
Purpose-built for AI agents, not bolted on. Three pillars that generic agent memory platforms can't offer.
Actors, CVEs, IOCs, TTPs stored as typed entities — not embeddings against raw text. Agents query by type, confidence, TLP, and temporal bounds. No more vector-similarity soup.
Causal relationships, alias resolution, campaign attribution. Actor → CVE → IOC → Campaign chains as first-class citizens. Every node carries confidence scores and evidence provenance.
Keyword + vector + structured CTI routing. Agents pass natural language; ThreatRecall routes to actor search, CVE lookup, IOC match, or graph traversal — whichever fits. STIX 2.1 compatible output.
TLP propagation, STIX 2.1 compatibility, evidence chain-of-custody, FedRAMP Moderate baseline. Multi-tenant isolation. OCSF-compliant audit logs. This is what generic agent memory tools cannot offer — not a bolt-on, it's the foundation.
ThreatRecall was designed around how security operations actually work — not adapted from general-purpose agent memory.
Traffic Light Protocol labels on every memory entry. Agents and analysts respect TLP boundaries — AMBER data stays with AMBER-clearance users, not leaked to the general memory pool.
Structured data in, STIX objects out. Actor, Malware, Indicator, Vulnerability — typed entities export as standard STIX 2.1 bundles. Integrates with MISP, OpenCTI, and any STIX consumer.
RBAC, audit logging, FIPS 140-2 encryption at rest and in transit. ATO-ready for U.S. federal and defense-adjacent environments. FedRAMP package available upon request.
Every IOC, CVE, and actor attribution carries provenance. Source, confidence score, linked evidence records. Audit trail that satisfies legal and compliance review — not just analyst convenience.
Every ingested observation grows the graph. Actor aliases resolve. Campaign chains link. Evidence trails propagate.
Same memory engine. You pick the operating model. No lock-in either way.
Self-host the memory engine. Free, MIT-licensed, authored by Patrick George Roland II. Typed memory model, blended retrieval, FastAPI interface. You run the infra.
Managed, multi-tenant, FedRAMP-aligned. We run the infra so your team focuses on threat intelligence — not ops. Enterprise-grade from day one.
You're building an AI-native SOC product. You need a memory layer your agents can query and write to — with STIX compatibility, TLP controls, and audit logging built in.
Multi-tenant threat memory across N client environments. Every analyst on every client gets the full recall of every engagement — no more siloed knowledge.
Your analysts are running AI agents. ThreatRecall gives those agents memory that persists, that carries context between sessions, that makes every AI-assisted investigation better than the last.
Your findings disappear after every engagement. ThreatRecall gives you a searchable threat memory — not a messy notes folder — so 6 months later you can ask "have I seen this before?" and actually get an answer.
"I'm Patrick Roland — Navy veteran, former MSSP director. Every SOC I've worked with loses investigations to agent session resets and analyst turnover. ThreatRecall is the memory layer I wanted from day one — for the AI agents we're all building and the analysts who need them to actually work."
ThreatRecall is live. Individual Researcher ($49/mo) and Pro ($199/mo) plans are available. Enterprise — contact sales.