---
name: threat-actor-dossier
description: >
  Build a consolidated profile of a named threat actor or group, combining attribution data with
  recent related news. Use this skill whenever a user names a threat actor/APT group (e.g. "tell
  me about APT29", "build a dossier on this group", "what do we know about [actor]") or asks for
  a profile after an investigation attributed activity to a named group. Also trigger when a
  triage or investigation report surfaces an actor attribution and the user wants to go deeper on
  that actor specifically. Do not use for generic "what is an APT" educational questions with no
  named actor — answer those directly.
---

# Threat Actor Dossier Skill

Consolidates attribution data, known TTPs, and recent related news into a single actor profile,
instead of separately checking three TI platforms and a news feed.

---

## Workflow Overview

```
1. Confirm the actor name/aliases  →  2. Pull attribution & TTP data  →  3. Pull recent news
   →  4. Correlate with internal history  →  5. Render dossier
```

---

## Step 1 — Confirm the Actor Name/Aliases

Threat actors are often tracked under multiple names by different vendors (e.g., the same group
may appear as APT29, Cozy Bear, Midnight Blizzard, or NOBELIUM depending on the source). Query
under the name given, and note aliases surfaced by the sources so later steps can catch aliased
references too.

---

## Step 2 — Pull Attribution & TTP Data

| Source | ID | What it adds |
|---|---|---|
| Mandiant Threat Intelligence | `mandiant_threat_intelligence_3_3_2_node_18_2e51baaa57_1697658645` | Actor profile, associated malware, targeted sectors/regions |
| Google Threat Intel | `google_threat_intelligence_3_1_2_node_18_bf9adae49f_1750966364421` | Threat-actor lookups, associated reports |
| AlienVault OTX | `alienvault_otx` | Community pulses referencing this actor |
| OpenCTI | `opencti` | Structured threat-actor graph entry, associated campaigns/malware/IOCs |
| Anomali ThreatStream | `threatstream_3_2_12_node_18_1738808367` | Commercial TI platform actor record if licensed |
| CrowdStrike Falcon X Intel | `crowdstrike_intel` | CrowdStrike's own actor/adversary tracking |

---

## Step 3 — Pull Recent News

| Source | ID | What it adds |
|---|---|---|
| Dataminr Pulse | `dataminr_3_0_0_node_18_1762356232_3_1_17_node_18_1768919523719` | Real-time alerts mentioning this actor |
| Dataminr News | `dataminr_3_2_0_node_18_9ff1b6c5c1_1777047161667` | News-correlated activity |
| Google Search / Custom Search | `google_search`, `google_custom_search_3_2_5_node_18_136a1a4574_1715269298` | General recent coverage if TI platforms are thin on this actor |

Prioritize the last 90 days of activity; older reporting is useful for TTP baseline but shouldn't
dominate the "what's happening now" section of the dossier.

---

## Step 4 — Correlate with Internal History

| Source | ID | What it adds |
|---|---|---|
| Jira | `jira` | Any internal tickets already attributed to this actor |
| Confluence | `confluence` | Existing internal runbooks or writeups on this actor |
| Elasticsearch (main) | `elasticsearch_3_6_5_node_18_f9729f7de9_1752502730003` | Any internal IOC matches tied to this actor's known indicators |

If internal history exists, lead with it — "we've seen this actor before, here's what happened"
is more actionable than a purely external profile.

---

## Step 5 — Render Dossier

Render via `visualize:show_widget`:

1. **Header** — actor name + known aliases, primary attribution source(s), last-active estimate
2. **Profile summary** — suspected origin/motivation (nation-state, financially motivated, etc.
   — stated as attributed by named sources, not asserted as fact), typical targets
3. **TTPs** — known malware families, initial access methods, notable techniques (MITRE ATT&CK
   IDs if sources provide them)
4. **Recent activity** — timeline of recent reporting/news, most recent first
5. **Internal history** — prior tickets/incidents attributed to this actor, if any
6. **IOCs associated with this actor** (if surfaced by sources) — offer to run these through the
   infrastructure pivot or triage skill for a fresh check rather than assuming they're still active
7. **Footer** — sources queried, confidence caveat (attribution is rarely 100% certain — state
   whose attribution this is, not an absolute claim)

### Visual Design Rules (all reports)

Follow the claude.ai design system exactly:

- **No hardcoded hex colors.** Use only CSS variables: `--color-background-primary/secondary/tertiary`,
  `--color-text-primary/secondary/tertiary`, `--color-border-tertiary/secondary`,
  `--color-background-danger/warning/info/success`, `--color-text-danger/warning/info/success`.
- **Dark mode mandatory** — every element must be readable on a near-black background.
- Font sizes: section labels 11–12px uppercase tracking, body 13–14px, metric numbers 20–24px.
  Font weights: 400 body, 500 headings/labels only. Never 600 or 700.
- Cards: `background: var(--color-background-primary); border: 0.5px solid var(--color-border-tertiary);
  border-radius: 12px; padding: 1rem 1.25rem`.
- Badges: `display: inline-block; padding: 4px 12px; border-radius: 6px; font-size: 12px; font-weight: 500`
  using semantic CSS vars for bg + text.
- Section separators: `border-top: 0.5px solid var(--color-border-tertiary)`.
- Tabler outline icons only (`<i class="ti ti-NAME" aria-hidden="true">`). Never filled variants.
- Sentence case everywhere. No ALL CAPS section titles.
- No gradients, drop shadows, blur, or glow effects.
- Score/meter bars: plain `<div>` with width `${value}%`, no canvas or chart libraries.
- Always render via `visualize:show_widget` (HTML mode). Call `visualize:read_me` with
  `modules: ["mockup"]` first if not already done this session. One line of prose before the
  widget call, nothing after except an offer to drill into any section.

---

## Handling Edge Cases

**Attribution conflicts between sources** (Mandiant says nation-state X, OTX pulse suggests a
different group): Present both, attributed by source, rather than picking one — attribution
disagreement is itself useful information for the analyst.

**Little to no data found**: Say so plainly rather than padding the dossier with generic APT
background; a thin dossier with an honest "limited public reporting on this actor" note is more
useful than a padded one.

**Actor name is ambiguous/ overlaps with a common word or another entity**: Confirm with the user
which specific group they mean before running searches, to avoid noisy off-target results.

**User asks to attribute a specific incident to this actor based on partial IOC overlap**: Be
careful not to overstate confidence — note that shared infrastructure or TTPs suggest possible
association, not confirmed attribution, unless a named source makes that direct claim.