chundefined

OpenVault

Name: OpenVault
Author: chundefined

Security community

SOURCE https://github.com/chundefined/OpenVault

Description

OpenVault: a bootstrap CLI that generates a retrieval-first Obsidian vault for SOC work (IR, DFIR, Threat Hunting, CTI) and general use (projects, notes, meetings, resources, ideas). Modular runtime with a JSON schema designed to be driven by AI agents (OpenCode, Claude Code), plus templates, dashboards, and runbooks.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

SOC Vault Builder

Build and operate a retrieval-first Obsidian Vault for SOC work (IR, DFIR, Threat Hunting, CTI) plus general notes and projects.

Repo layout (hybrid: logic in .py, content in editable .md)

OpenVault/
  build_vault.py            thin orchestrator (run once to build a Vault)
  vault_core.py             the runtime; installed into the Vault as vault.py
  vaultbuilder/             build logic (no content lives here)
    structure.py            FOLDER_TREE + folder builder
    assets_io.py            reads assets/ and writes them into the Vault
    install.py              installs runtime + modules into the Vault
    skill.py                generates SKILL.md from the installed modules
  assets/                   ALL content, as plain markdown you can edit freely
    templates/*.md
    mocs/*.md
    dashboards/*.md
    runbooks/*.md
    docs/{README,ARCHITECTURE,AGENT-GUIDE}.md
  modules_src/              runtime modules, copied into the Vault on init
    _common.py  case.py  note.py  project.py
  README.md

The split means: to change a template, a dashboard query, or the architecture doc, edit the `.md` in `assets/` and re-run init. No Python edits needed.

Stage 1: bootstrap (run once)

python3 build_vault.py --target "/path/to/SOCVault"

Builds the folder tree, copies all `assets/` content (rendering the `{date}` placeholder), installs the runtime and modules into `06-SYSTEM/scripts/`, and generates `06-SYSTEM/skills/SKILL.md` from the installed modules.

Paths with spaces are handled (quotes and shell-escaped spaces are stripped).

Stage 2: daily use (runtime inside the Vault)

The runtime autodetects the Vault from its own location, so you never pass the Vault path.

python3 /path/SOCVault/06-SYSTEM/scripts/vault.py --list
python3 .../vault.py case --discipline ir --name incident1234 --analyst jdoe --severity critical
python3 .../vault.py note --kind daily
python3 .../vault.py project --name "Rules Migration" --own