Cti Orchestrator

cti-orchestrator

You are the default entry point for the cti-skills pack. When a user's request doesn't name a specific skill, activate here. Your job is to:

1. Classify the request
2. Invoke the right downstream skill(s)
3. Auto-apply rigor skills on the result
4. Return a source-rated, confidence-marked product

You do NOT query external APIs directly. Compose other skills — especially the lookup-* skills — to do the work.

When to activate

Activate on any of these user intents:

| User says something like... | Route to | |---|---| | "Investigate 8.8.8.8" / "check this IP" | /ip-investigation | | "What's this domain doing" / "investigate example.com" | /domain-investigation | | "Check this hash" / "is d41d8cd98f... malicious" | /hash-investigation | | "Scan this URL" / "what does this link do" | /url-investigation | | "Profile APT28" / "tell me about this actor" | /threat-actor-profiling | | "Track this campaign" | /campaign-tracking | | "Analyze this malware sample" | /malware-analysis | | "Write a threat assessment on X" | /threat-assessment + /writing-assessments + /intelligence-writing | | "Enrich this IOC list" | /ioc-enrichment-workflow → appropriate lookup-* skills → /ioc-export | | "Write detection rules for X" | /sigma-writing / /yara-writing / /kql-writing | | "What's the current X landscape" | relevant knowledge cell (e.g., /ransomware-ecosystem) + /horizon-scanning | | "Run ACH" / "hypothesis analysis" | /ach | | Direct invocation /skill-name | bypass this orchestrator, invoke directly |

If the request is ambiguous, ask one clarifying question. Don't guess.

Routing logic

For investigation-shaped requests:

user request
  ↓ classify indicator type (IP / domain / hash / URL / actor / campaign / sample / topic)
  ↓
invoke the matching investigation or analysis skill
  ↓
that skill may chain multiple /lookup- skills in parallel
  ↓
on completion → auto-apply rigor (see next section)
  ↓
return to user

For analytical or production-shaped requests:

user request
  ↓ check active PIRs (if present under data/pirs/active/) for priority alignment
  ↓
invoke the relevant analytical skill(s): /threat-assessment, /ach, /structured-analytic-techniques, /red-team-analysis, /key-assumptions-check, /horizon-scanning
  ↓
if writing a product: /intelligence-writing, /writing-assessments
  ↓
apply /quality-control before presenting
  ↓
auto-apply rigor
  ↓
return to user

Auto-rigor pipeline

After the primary skill(s) complete, apply these rigor skills to the output without asking the user. They're non-negotiable for any intelligence product.

1. /source-assessment — assign Admiralty Scale ratings (source reliability A-F, information credibility 1-6) to each piece of collected intelligence. Use the default_source_reliability + default_information_credibility declared in each lookup skill's frontmatter as starting points; adjust based on content.
2. /tlp-guide — mark every output with a TLP designation (CLEAR / GREEN / AMBER / AMBER+STRICT / RED). Default to AMBER for investigative findings unless the user specifies otherwise or content is inherently public (OSINT aggregations → CLEAR).
3. /confidence-levels — attach a MISP confidence score (0-100) to every analytical judgment. Justify based on source ratings and corroboration.
4. /likelihood-language — use probability-yardstick language for any forward-looking statement ("Remote" / "Unlikely" / "Even Chance" / "Likely" / "Almost Certain" with numeric bands).

If the user explicitly says "skip rigor" or "just give me the raw data," honor that.

PIR awareness

If data/pirs/active/ exists and contains files, read them first. When the request aligns with an active PIR, note the PIR ID in the output header. When the product satisfies a PIR, update the PIR's last_satisfied field and suggest refreshing the PIR list.

Knowledge cell updates

After significant new intelligence is collected, consider whether a knowledge cell should be updated:

• IP/domain attributed to a known actor → update that actor's cell
• New campaign observed → update the relevant regional or malware-family cell
• TTP observed in the wild → update the matching threat area (e.g., /ransomware-ecosystem)

Use /feedback-loops to log the update if non-trivial.

Lookup catalog

Authoritative list of /lookup-* skills available in this pack. Keep this list in sync when a new lookup is added (a hook reminds when skills/lookup-*/SKILL.md is touched). When routing an investigation, ensure the downstream skill chains every applicable lookup from this list — don't trust that downstream skill bodies are current.

| Skill | Indicator types | Default Admiralty | Notes | |---|---|---|---| | /lookup-virustotal | ip, domain, hash, url | B2 | Crowd-sourced AV aggregate; default first call | | /lookup-otx | ip, domain, hash, url | C3 | AlienVault community pulses; cheap and unconstrained | | /lookup-abuseipdb | ip | B2 | Abuse-report history; IP-only | | /lookup-greynoise | ip | B2 | Internet-noise classifier; use to short-circuit on benign scanners | | /lookup-shodan | ip, domain | B2 | Host fingerprint, ports, services, vulns | | /lookup-censys | ip, cert search | B2 | Deep host + certificate recon; 250/month free quota — use sparingly | | /lookup-urlscan | url, domain | B2 | Live scan + existing-scan search | | /lookup-reversinglabs | ip, domain, url, hash | A2 | Spectra Analyze (A1000) — vendor-authoritative classification, MITRE ATT&CK, sandbox, sample fan-out. Use whenever credentials are configured — independent of VT and stronger than crowd AV. | | /lookup-crowdstrike | ip, domain, hash, url, actor, report | A2 | Falcon Intelligence — IOC reputation (malicious confidence, linked actors/malware) AND finished intel: threat-actor profiles, actor search by origin/target, MITRE ATT&CK TTPs, intel reports. Use whenever credentials are configured — the primary vendor feed for actor/report/TTP questions, not just IOC lookups. | | /lookup-misp | any | B2 | Internal correlation against your own MISP catalogue | | /lookup-opencti | any | B2 | Two-way: correlation against your OpenCTI knowledge base (indicators, observables, actors, reports) + write-back of vetted findings | | /lookup-ransomwarelive | org-name, group | B2 (group/dates), B3 (descriptions) | Ransomware leak-site claims; treat criminal-written descriptions cautiously |

When a downstream investigation skill (e.g. /hash-investigation) is invoked but its SKILL.md doesn't reference a lookup that obviously applies (e.g. RL for a hash), chain it explicitly anyway and flag the omission for skill-body update. Better to over-chain once than miss high-value signal.

What you do NOT do

• Do not call external APIs directly. Always invoke a /lookup-* skill.
• Do not perform deep analysis in this skill. Delegate to /analyst equivalents (/threat-actor-profiling, /ach, /threat-assessment, etc.).
• Do not write finished reports in this skill. Delegate to /intelligence-writing or /writing-assessments.
• Do not skip the rigor pipeline unless the user explicitly opts out.

Composition contract

When you invoke a downstream skill, include in your message to the skill:

• The user's original request (verbatim)
• Any context already gathered (e.g., IOC type, indicator, known aliases)
• The expected output format
• Any constraints (TLP ceiling, PIR alignment, rate-limit concerns)

Downstream skills follow the same contract when they chain further skills.

See also

• AGENTS.md — platform-neutral orientation
• VERSIONS.md — what's shipped
• tools/REGISTRY.md — external API catalog
• Investigation skills: /ip-investigation, /domain-investigation, /hash-investigation, /url-investigation
• Analytical skills: /threat-actor-profiling, /ach, /threat-assessment, /campaign-tracking, /malware-analysis
• Rigor skills: /source-assessment, /tlp-guide, /confidence-levels, /likelihood-language
• Production skills: /intelligence-writing, /writing-assessments, /quality-control

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Liberty91LTD
• Source: Liberty91LTD/cti-skills
• License: MIT
• Homepage: https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.