# The knowledge base

> Oyster's curated, source-attributed security knowledge base — what it contains, how it is used in Security Intel, and how it differs from your own files and from model training.

Source: https://documentation.redorca.ai/understand/knowledge-base/
Last updated: 2026-11-01

Oyster keeps a curated, source-attributed knowledge base of security reference material. It is searchable reference text, not model training data: every passage keeps its source, so an answer built from it can cite where each fact came from.

## What it contains

Public security references, including:

- **Vulnerability and weakness records** — CVE entries, CWE weakness classes and CAPEC attack patterns, and the list of known exploited vulnerabilities.
- **Adversary behaviour** — MITRE ATT&CK techniques, with their mitigations and detection data.
- **Defensive countermeasures** — MITRE D3FEND.
- **Standards and guidance** from public projects such as OWASP and NIST publications, and detection content such as Sigma rules.

Each source keeps its licence and attribution, and citations link back to the original where it is public.

## Where it is used

**Security Intel** answers from the knowledge base and shows its sources. See [Security Intelligence](https://documentation.redorca.ai/guides/security-intelligence/). Installing, updating and managing knowledge sources is done by Red Orca's operators; accounts read it, they do not change it.

## Your files are separate

The files you upload are stored apart from the knowledge base, in your own project. A question about your files is answered from your files; curated knowledge does not leak into those results, and your files never enter the shared knowledge base. See [Isolation](https://documentation.redorca.ai/understand/isolation/).

## When it does not know

If the knowledge base has nothing on a question — or no record of an identifier — Oyster says so instead of inventing an answer.