7onez/cti-expert

7onez/cti-expert

Command

Part of cti-expert

Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment. Usage: /cti-case [seed...].

7onez/cti-expert

Command

Part of cti-expert

False-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage: /cti-check.

7onez/cti-expert

Command

Part of cti-expert

Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster.

7onez/cti-expert

Command

Part of cti-expert

Collect pivot artifacts from ONE target — favicon, trackers, wallets, emails, CORS, mail/SPF/DMARC, WHOIS, co-tenancy. Usage: /cti-pivot [--passive].

7onez/cti-expert

Command

Part of cti-expert

Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall.

7onez/cti-expert

Command

Part of cti-expert

Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report [--graph|--pdf].

7onez/cti-expert

Command

Part of cti-expert

Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status.

7onez/cti-expert

Command

Part of cti-expert

THE ENTRY POINT for cti-expert. Investigate any target — domain, IP, email, username, phone, wallet, hash or APK. Routes to the right chain automatically. Usage: /cti [--deep|--quick|--passive].