Clusters

Unattributed activity sets tracked by behaviour. Analogous to Mandiant UNC, Microsoft DEV/Storm, CrowdStrike Spiders-in-development.

GET/clusters

Returns all clusters with aliases.

GET/clusters/:id

Full cluster detail with edges and reports. Accepts UUID or slug.