The wiki catches up with the four knowledge bases
It only knew ATT&CK, and said so in places where it is now wrong rather
than merely incomplete: picking an entry no longer writes a mitre-attack
reference whatever the entry was, the left panel is not called ATT&CK any
more, and the suggestion table named Enterprise when the corpus is three
matrices.
Canvas reference gains a section on the frameworks panel, the overlap
that makes F3 the interesting one, and what a pick becomes in the bundle;
and a section on the narrative, which grew a chronology, an hour and a
reason for the per-subject version to exist only in a report.
Exporting had the PDF as a capture with text after it, which is no longer
the layout, and claimed the narrative checkbox was still labelled in
French, which stopped being true in August. It now covers the timeline
option too.
How it is built and Contributing both counted three dataset scripts.
There are six, the order between two of them matters, and adding a
seventh has a page of its own in the repository.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZKZRDMVAdrWUQP2crYVXH
Documentation: eleven pages, each checked against the code
The wiki holds what the repository cannot: walkthroughs, operating knowledge,
and the reasoning behind how the pieces fit together. It deliberately does not
restate the README, SECURITY.md, docs/identifiers.md or the two in-app pages,
because documentation that drifts from the code is worse than none, so it
links to them instead.
Every page was written against the source rather than from memory, then read
back by someone who had not written it and owed it nothing. That second pass
caught a keyboard shortcut attributed to the wrong palette entry, three
environment variables presented as governing an enricher that hard-codes its
own, a build described as three steps when the fourth is the one that is not
committed, and a TLP procedure that could not be performed as written because
the panel it named only appears for a multiple selection.
One page carries knowledge that is in no file: importing through a draft
rather than a workbench. It is stated as what it is, an observation against
one instance at one point in time, because that is the honest way to pass on
something the code cannot confirm.
pak
committed
Aug 12, 2026