Command shell. Chat equivalent:
/cti-case,/cti-cluster,/cti-recallin 03.
Why use it: this is the deterministic path (no LLM) that runs the whole loop: collect → load into KB → find overlaps → score risk → cluster.
What it produces: intel_engine/cases/<CASE-ID>/ contains raw/*.json, graph, report; and KB at intel_engine/knowledge/.
One-case-store rule (read first, failures here are very silent)
$INTEL_HOME/cases/<CASE-ID>/ # = intel_engine/cases/<CASE-ID>/
CLI, pipeline and MCP server all resolve to exactly this location. Confirm:
python3 scripts/backend/backend.py status
python3 scripts/backend/intel.py cases --path
Do not create cases/ at the repo root and do not pass -o cases/.... yourself. It is gitignored so it looks harmless, but the silent consequence: kb_ingest reads $INTEL_HOME/cases/ finds nothing, correlation runs on an empty set and reports "no shared indicators" instead of reporting an error. If you see "no raw pivot JSON in …" then you wrote to the wrong path — that is not a bug (CLAUDE.md RULE 2).
Open a case
# 1. seed file: mỗi dòng một domain/URL
cat > /tmp/seeds.txt <<'EOF'
site-a.example
https://site-b.example/login
EOF
# 2. xem trước lệnh thật
python3 scripts/backend/intel.py --dry-run pipeline open CASE-0001 /tmp/seeds.txt
# 3. chạy
python3 scripts/backend/intel.py pipeline open CASE-0001 /tmp/seeds.txt
pipeline has exactly 4 sub-commands (intel_engine/tools/intel.py): open, loop, clusters, status.
Flags worth knowing for open:
| Flag | Effect | Costs credit? |
|---|---|---|
--jobs N |
parallelise collection | no |
--whois-reverse |
enable reverse-WHOIS | yes (WhoisXML DRS) |
--fofa-full |
reverse FOFA across the entire history instead of ~1 year | yes |
--serp [--serp-region CODE] |
ad layer: Google Ads Transparency → verified accounts that are paying and the legal name of the sponsor (survives WHOIS privacy and domain rotation) | yes (1 SerpApi search/host) — so it is opt-in |
--render-extract / --render |
render DOM after JS (unlocks SaaS/analytics tokens) | no, but needs playwright |
--archive |
save evidence | no |
--no-pssl, --no-graph, --no-report |
skip stages | — |
--force |
rerun despite having cache | depends on the stage |
--analyst, --classification, --operator |
metadata for the report | no |
Free cloaking probe still runs even without --serp.
Status, convergence, and unexploited edges
python3 scripts/backend/intel.py pipeline status CASE-0001 # audit output đã lưu
python3 scripts/backend/intel.py frontier CASE-0001 # seed MIỄN PHÍ kế tiếp + lead có phí bị hoãn
python3 scripts/backend/intel.py loop CASE-0001 # collect→assess lặp tới khi hội tụ
python3 scripts/backend/intel.py reopen CASE-0001 # mở lại case nguội khi có seed mới
frontier is the answer to "what is left to do that costs no money" — run it before deciding to buy more credit.
Clustering: the unit of judgement is the CLUSTER, not the case
python3 scripts/backend/intel.py clusters CASE-0001
clusters collects nothing — it splits an existing case into same-operator components. Run it before concluding, because one case often contains many unrelated operators.
Query the KB
python3 scripts/backend/intel.py kb --stats
On a clean clone (real run):
entities: 0 facts: 0 edges: 0
by type: {}
edges by rel: {}
facts by source: {}
An empty KB is correct — intel_engine/knowledge/ is gitignored, each machine builds its own.
python3 scripts/backend/intel.py recall site-a.example # "đã gặp chưa?" — chạy TRƯỚC khi thu thập
python3 scripts/backend/intel.py kb --entity site-a.example # fact + edge của một entity
python3 scripts/backend/intel.py kb --cluster site-a.example # domain chia sẻ chỉ dấu
python3 scripts/backend/intel.py kb --cluster site-a.example --strong --max-prevalence 8
python3 scripts/backend/intel.py kb --shared --min 2 # chỉ dấu dùng chung toàn KB
--strong is a flag worth using by default when concluding. It removes edge boilerplate (shared CSS/DOM templates) and any indicator appearing in more than --max-prevalence domains (default 8) — i.e. generic favicon kits, email registrars. Without it, you easily mislink things like "both use WP-Rocket".
Loading and cleaning
python3 scripts/backend/intel.py ingest --case CASE-0001 # nạp output webpivot vào KB
python3 scripts/backend/intel.py ingest-rwhois <file> # nạp kết quả reverse-WHOIS
python3 scripts/backend/intel.py hypothesize # xếp hạng giả thuyết cùng-operator
python3 scripts/backend/intel.py risk --case CASE-0001 # NRD / bulletproof hosting / money trail
python3 scripts/backend/intel.py clean # vệ sinh KB
python3 scripts/backend/intel.py export-graph # xuất đồ thị
False-positive control
python3 scripts/backend/intel.py noise <indicator> # hạ tầng dùng chung?
python3 scripts/backend/intel.py reference check favicon:123456789 # BENIGN / SIGNAL / UNKNOWN
python3 scripts/backend/intel.py reference add ... # sổ FP đã kiểm chứng
This book is the only exception to RULE 1: it is allowed to contain real indicator values, because that is precisely its job — and it lives in the gitignored KB, not in a tracked file.
The LLM path (NOT YET ACTUALLY RUN — needs .venv)
python3 scripts/backend/intel.py harness open CASE-0001 https://site-a.example
python3 scripts/backend/intel.py harness continue CASE-0001
python3 scripts/backend/intel.py harness status CASE-0001 # không gọi LLM, không cần API key
python3 scripts/backend/intel.py tool-calls CASE-0001 # model THỰC SỰ đã gọi gì
tool-calls is what is used to verify the agent — it reads the audit log, not the agent's account.