Azazel-Knowledge Advisor

Development codename: GRIMOIRE — the accumulated book of threats; a grimoire never casts its own spells. Codenames follow the series convention (see Naming Convention) and never appear in formal external naming.

Formal series designation: Azazel-Knowledge Advisor, series number AZ-04. Formerly Azazel-CTI (working name); see Naming Convention for the ratified decision.

Subtitle: On-Premises Tactical Threat Knowledge Advisor.

Azazel-Knowledge accumulates and correlates IOC, ATT&CK, attacker reactions, and behavioral patterns, and only advises: it never commands. Final authority always stays with Azazel-Edge’s deterministic arbiter, which keeps working if the node is absent, slow, or wrong. Its generated detection rules are likewise drafts it never deploys.

Role

Advisory-only, deterministic, on-premises tactical CTI node that supplies threat context to the deterministic edge without ever taking authority.

Doctrine Implementation Focus

The CTI node never commands. It returns threat context, confidence, reasons, and recommendations as advisory data only. Final authority always stays with Azazel-Edge’s deterministic arbiter.
Fail-safe by absence. Edge remains fully functional if the CTI node is absent, slow, or wrong.
Offline-first operation: signed offline bundles plus optional scheduled feed pulls, so the query path carries no internet dependency.
Deterministic, explainable scoring: the same inputs replay byte-for-byte, and every score carries a complete reason set.
STIX 2.1 / TAXII 2.1 at the boundary only; SQLite for local storage.

Typical Use Cases

Enriching edge decisions with local threat context on constrained, on-premises hardware
Deterministic, auditable scoring where explainability matters more than model complexity
Behavioral CTI (Phase 2): reaction to pattern to similarity to advisory, shadow-gated, with no machine learning

Target

Raspberry Pi 4, on-premises. MIT license.