What CTI integrations do you need?

[rolandpg]

ZettelForge currently integrates with:

ATHF (Agentic Threat Hunting Framework) -- examples/athf_bridge.py
OpenCTI [Enterprise] -- bi-directional sync
Claude Code -- MCP server for agent memory
What else would be valuable?

Some ideas we've heard:

MISP import/export
TheHive/Cortex integration
Elastic SIEM connector
TAXII/STIX feed ingestion
Splunk SOAR plugin
Vote with a thumbs up on the ones you'd use, or add your ow

[rolandpg]

Integrations I am considering (feedback welcome on priority):

High priority:

• MISP JSON import — good-first-issue Add example: ingest MISP JSON feed #44 is open for this
• OpenCTI sync — basic sync client exists, needs rebuild for community use
• Splunk/Elastic SIEM export — query ZettelForge from your SIEM

Medium priority:

• TAXII 2.1 client — pull STIX bundles from any TAXII server
• VirusTotal enrichment — auto-enrich hashes/domains/IPs
• Shodan lookup — enrich IP IOCs with hosting/port data

Community requests (vote with a thumbs up):

• Cortex/TheHive integration
• YARA rule matching on stored IOCs
• Slack/Teams alerting on new high-confidence intel

What integrations would make ZettelForge useful for your workflow?