/cti-cluster
Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>
$ npx -y skills add 7onez/cti-expert --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/cti-cluster
Context preview
What this command does when you run it.
Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>
Command definition
cti-cluster.mdname: cti-cluster description: "Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>" argument-hint: "<domain|CASE-ID>"
/cti-cluster — correlate and expand
Load the `cti-expert` skill, then expand: `$ARGUMENTS`
Work **down** the SKILL.md §2.5 priority ladder — highest-strength evidence first:
| Rung | Check | Call | |---|---|---| | 1–2 | registrant email/phone/org, incl. **historic** WHOIS; alias bridges | `intel.py whois` · `reverse-whois` | | 3 | site-verification tokens (proves account control) | in `shared.txt` | | 4 | TLS cert / SAN overlap | `mcp__intel__cert_overlap` | | 5 | nameserver delegation to a **self-hosted** NS | in `shared.txt` | | 7 | favicon / tracker / tenant IDs | `mcp__intel__kb_cluster` | | 8–10 | co-tenancy, managed-provider NS, site kit | weak — corroborate or demote |
**Reverse-WHOIS is the highest-yield pivot here — always `mode=preview` first.** The count is free; a term returning hundreds is shared boilerplate and must not be purchased or clustered on.
Run `/cti-check` on every indicator before it becomes an edge. Report each asserted link with the rung it rests on, so a reader can weigh it.
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code. 67+ commands, 35 techniques, no API keys required.
Repo: 7onez/cti-expert
Other commands on cti-expert.
- /cti-case
Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment. Usage: /cti-case <CASE-ID> <seed> [seed...]
Open command - /cti-check
False-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage: /cti-check <indicator>
Open command - /cti-pivot
Collect pivot artifacts from ONE target — favicon, trackers, wallets, emails, CORS, mail/SPF/DMARC, WHOIS, co-tenancy. Usage: /cti-pivot <url|domain|ip> [--passive]
Open command - /cti-recall
Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall <domain|indicator>
Open command - /cti-report
Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report <CASE-ID> [--graph|--pdf]
Open command - /cti-status
Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status
Open command