Using the Knowledge Base

The knowledge base is where methodology, cheat-sheets, and your own notes live. It's searchable by keyword and by meaning.

What's in the KB

Three kinds of content:

• Playbooks — fourteen methodology frameworks with structured phases and tasks
• Cheat-sheets — 108 references covering GTFOBins, LOLBAS, RevShells, HackTricks, PayloadsAllTheThings, and command references
• Your own articles — anything you write and want to keep

All of it lives in the same index. Search across all of it with one query.

Browsing

The Knowledge section in the sidebar lists every article. Articles are grouped by category:

• Methodology — playbooks and frameworks
• Cheat-sheets — reference material
• Notes — your own articles
• References — external links and excerpts

Each article shows its title, summary, category, and tags.

Article structure

Articles are written in Markdown. Headings, lists, tables, code blocks, links — everything you'd expect.

Code blocks get syntax highlighting via Shiki, with a copy button on hover.

Articles can be:

• Pinned — appear at the top of the category
• Tagged — with any number of tags for filtering
• Drafted — saved but not yet published

Writing an article

From Knowledge, click New article.

Fill in:

• Title — the display name
• Slug — URL-friendly identifier, auto-generated from title
• Summary — one-line description, shown in lists
• Category — methodology, cheat-sheet, note, reference
• Body — the Markdown content

Optional:

• Pinned — toggle to feature at the top
• Tags — add any number

Save. The article is live immediately.

Editing and deleting

Open any article to view it. If you wrote it, an Edit button appears.

Click Edit to open the editor. Change anything, save. The URL stays the same — the slug doesn't change unless you change it explicitly.

To delete an article, use the menu in the editor. Deletion is permanent — the audit log records it.

Tags

Tags are how you organize across categories. For example:

• ad — Active Directory
• cloud — Cloud security
• web — Web application testing
• windows — Windows-specific techniques
• linux — Linux-specific techniques

Add tags when you create or edit an article. Filter the list by tag with one click.

Keyword search

The knowledge list has a search box. It matches against:

• Article titles
• Summaries
• Body content
• Tags

Keyword search uses Meilisearch — fast, typo-tolerant, and supports prefix matching.

Semantic search

Beyond keyword search, ATHELOS supports semantic search: searching by meaning rather than by exact words.

Toggle semantic mode from the search interface. In semantic mode:

• You describe what you want in natural language
• The system finds articles whose meaning is close to your query
• Results are ranked by semantic similarity, not keyword overlap

Example: searching for "how do attackers move laterally in Active Directory" finds Kerberoasting, Pass-the-Hash, DCSync, and delegation articles — even if none of them contain the exact words in the query.

Semantic search requires the local AI runtime. See AI: Semantic search for setup.

Command palette

Press Ctrl+K (or Cmd+K on macOS) anywhere in ATHELOS. The command palette opens.

Type to search:

• Navigate to any page
• Search knowledge articles (keyword + semantic)
• Search certifications and labs
• Run actions

Results are grouped by type. Press Enter to jump to the top result.

The palette is often faster than clicking through the sidebar.

Backlinks

When one article links to another, ATHELOS tracks the connection.

Open an article and scroll to the bottom. The Referenced by section shows every article that links to this one.

This makes it possible to discover relationships you didn't know about. Landing on "Kerberoasting" shows that the "AD Attack Playbook" and the "Golden Ticket" article both link to it.

Cheat-sheets

The 108 cheat-sheets that ship with ATHELOS are all articles. You can:

• Browse them by category
• Search across them
• Link to them from your own notes
• Reference them from within engagements

They're read-only in the sense that they come pre-loaded. But you can edit them, add notes, or copy them to make your own version.

Playbooks as KB articles

Every playbook is also a knowledge article. This means:

• You can read a playbook without loading it onto an engagement
• You can search for specific tasks across all playbooks
• The same content serves as reference material and live checklist

See Using playbooks for how to load one onto an engagement.

Importing content

The KB is designed for both pre-loaded content and your own articles. If you have existing notes in Markdown, you can import them.

From the CLI:

pnpm seed:kb

This loads the default set of playbooks and cheat-sheets. Your own articles are added through the UI.

Exporting content

Individual articles can be copied as Markdown. Full export is available via the CLI — useful for backups or migrating to another tool.

Where to go next

• Using playbooks — methodology on engagements
• AI: Semantic search — searching by meaning
• AI: RAG chat — asking questions of your KB