Clusters

Unattributed activity sets tracked by behaviour. Analogous to Mandiant UNC, Microsoft DEV/Storm, CrowdStrike Spiders-in-development.

GET/clusters

Returns all clusters with aliases.

GET/clusters/:id

Full cluster detail with edges, reports, and inherited_campaigns (campaigns attributed to the cluster). Accepts UUID or slug.

GET/clusters/:id/timeline

Returns the cluster's timeline events as an array (empty if none). Accepts UUID or slug.