7onez/cti-expert

What it solves

CTI Expert is a toolkit designed to transform an LLM (specifically Claude) into a professional cyber threat intelligence (CTI) and open-source intelligence (OSINT) analyst. It solves the problem of fragmented intelligence collection by providing a structured, multi-vector reconnaissance framework that automates the gathering, enrichment, and assessment of data on targets such as people, domains, organizations, usernames, emails, and IP addresses.

How it works

The project operates as a "Claude Code skill" using a two-layer architecture:

1. Broad Collector: A wide-net collection layer featuring over 120 commands and 57 techniques to acquire raw data.
2. Deep Pipeline: An internal engine (intel_engine/) that processes raw collection into formal cases. This includes maintaining a persistent knowledge base, versioning cases, correlating data across cases, and performing calibrated assessments.

It follows the AEAD Workflow: Acquire raw data $\rightarrow$ Enrich with pivot expansion $\rightarrow$ Assess findings $\rightarrow$ Deliver structured reports. While core functionality is keyless, users can add API keys for services like Shodan, Censys, and VirusTotal to unlock higher-tier pivots and deeper data.

Who it’s for

Cyber threat intelligence analysts, OSINT investigators, and security researchers who need a standardized, automated way to conduct reconnaissance and produce professional intelligence reports (PDF, DOCX, HTML).

Highlights

• Extensive Command Set: Over 120 commands and 57 techniques for multi-vector reconnaissance.
• Keyless Core: Core techniques run without API keys, though optional keys unlock advanced capabilities.
• Deterministic Reporting: Generates comprehensive "house reports" (PDF/DOCX) containing relationship graphs, attribution chains, and temporal views without requiring a model to write the final text.
• Gated Malware Analysis: Includes a highly gated submission process for ANY.RUN to ensure privacy and prevent accidental public exposure of samples.
• Broad Integration: Integrates with numerous TI providers including Netlas, Shodan, Censys, and IntelX.