/ Diretório / Playground / cti-expert
← Todos os servidores ↗ GitHub
● Comunidade 7onez ⚡ Instantâneo

cti-expert

por 7onez · 7onez/cti-expert

Defensive CTI + OSINT analysis skill for Claude Code — 67+ commands and 35 techniques, no API keys required.

cti-expert turns Claude Code into a junior cyber threat intelligence analyst: it enumerates analytic techniques (ACH, SATs, diamond model, kill-chain mapping), pulls OSINT from public sources, and writes up findings in structured formats (STIX-flavored, MITRE ATT&CK-aligned). It is a defensive skill — it does not include offensive or exploit tooling.

▶ Ver demo 📦 Instalar 💡 Casos de uso

Por que usar

Principais recursos

Demo ao vivo

Como fica na prática

cti-expert-skill.replay ▶ pronto
0/0

Instalação

Repositório do autor · Documentação oficial de Skills do Claude

Casos de uso

Usos do mundo real: cti-expert

How to enrich a suspicious indicator (IP, domain, hash) with public OSINT

👤 SOC analysts, incident responders, blue-team engineers ⏱ ~15 min intermediate

Quando usar: You have an IOC from an alert and need context before escalating.

Fluxo
  1. Submit the indicator
    Enrich 185.234.218.95 using public OSINT — WHOIS, passive DNS (free sources), reputation feeds.✓ Copiado
    → Structured context: ASN, geo, historical resolutions, known bad
  2. Map to MITRE ATT&CK if applicable
    If this matches a known campaign, map to ATT&CK tactics/techniques.✓ Copiado
    → TTP list with ATT&CK IDs
  3. Write up
    Produce a tactical report: what it is, confidence level, recommended actions.✓ Copiado
    → Short, decision-oriented write-up

Resultado: A defensible enrichment you can attach to a ticket in minutes.

Armadilhas
  • Treating reputation scores as ground truth — Record the source + date; note confidence explicitly
  • OSINT queries accidentally tip off the target — Only use passive sources; no active scanning
Combine com: filesystem

Draft a campaign write-up from a handful of artifacts

👤 CTI analysts producing internal reports ⏱ ~45 min advanced

Quando usar: You've been asked to turn a pile of IOCs, TTPs, and notes into a readable brief.

Fluxo
  1. Collate the artifacts
    Here are the IOCs and notes. Cluster them by diamond-model facet (adversary, capability, infra, victim).✓ Copiado
    → Diamond-model-shaped clustering
  2. Map to ATT&CK
    Map observed behaviors to ATT&CK; note coverage gaps.✓ Copiado
    → Coverage matrix
  3. Write the brief
    Produce an executive section, a tactical section, and an IOC appendix.✓ Copiado
    → 3-part report

Resultado: A consistent, audience-tiered report ready for review.

Armadilhas
  • Inflating confidence language ('almost certainly') — Force IC-style qualifiers (high/moderate/low) with reasoning

Run an ACH (Analysis of Competing Hypotheses) walk-through

👤 Analysts wrestling with ambiguous attribution ⏱ ~30 min advanced

Quando usar: Multiple actors could explain the evidence; you want structure before picking one.

Fluxo
  1. List hypotheses + evidence
    Hypotheses: H1, H2, H3. Evidence: E1–E10. Set up the ACH matrix.✓ Copiado
    → Matrix with consistency marks per cell
  2. Identify diagnostic evidence
    Which evidence items have the highest diagnostic value?✓ Copiado
    → Evidence ranked by ability to discriminate
  3. Report the least-inconsistent hypothesis
    Pick the least-inconsistent hypothesis and list what would flip it.✓ Copiado
    → Selection + counter-evidence triggers

Resultado: A transparent attribution decision with documented reasoning.

Armadilhas
  • Anchoring on the first hypothesis — Force the matrix first, conclusion last

Combinações

Combine com outros MCPs para 10× de alavancagem

cti-expert-skill + filesystem

Process a directory of raw alerts into structured findings

Enrich every IOC under alerts/2025-04-01/ and produce a consolidated daily tactical report.✓ Copiado

Ferramentas

O que este MCP expõe

FerramentaEntradasQuando chamarCusto
indicator-enrichment IOC (IP/domain/hash/URL) Triage of any incoming indicator free OSINT queries
attck-mapping observed behaviors When writing up campaigns or detections 0
structured-analytic-techniques hypotheses + evidence Ambiguous analysis problems 0
report-templates findings Final reporting step 0

Custo e limites

O que custa rodar

Cota de API
depends on the OSINT sources used; all default sources are free-tier
Tokens por chamada
2–10k tokens per indicator workflow
Monetário
free
Dica
Start with passive sources only; add paid feeds only if coverage gaps justify it

Segurança

Permissões, segredos, alcance

Armazenamento de credenciais: none by default; any paid feed API key lives in env vars
Saída de dados: only the OSINT endpoints you allow-list

Solução de problemas

Erros comuns e correções

Rate limited by a public source

Throttle or switch to an alternate source — many OSINT endpoints are sensitive

Claude hallucinates an enrichment result

Require citations for every claim; reject unsourced enrichment

ATT&CK mapping is too generic

Provide concrete behaviors (processes, commands, network patterns), not high-level summaries

Alternativas

cti-expert vs. outros

AlternativaQuando usarTroca
claude-cybersecurity-skillYou want broader security skills, not just CTIWider but shallower in CTI specifics
claude-security-research-skillYou're researching vulnerabilities rather than triaging indicatorsDifferent job entirely

Mais

Recursos

📖 Leia o README oficial no GitHub

🐙 Ver issues abertas

🔍 Ver todos os 400+ servidores MCP e Skills