Claude Code for Threat Intelligence: Turning a Coding Agent into a CTI Workstation.

Yes, you can use Claude Code for threat intelligence, and it is one of the most practical ways for an analyst to get hands on AI-assisted CTI today. Claude Code is Anthropic's agentic command-line tool. Unlike a chat window you paste a report into, it has tools, a filesystem, and reusable skills, which is exactly the shape a real intelligence workflow needs. Point it at your own API keys and your own MISP instance, load a pack of CTI skills, and a single analyst can run integration, entity extraction, analytical tradecraft, self-maintaining knowledge, organisation-relevance, and report production against live indicators, from the terminal. The agent does the mechanical work and runs the structured technique on every indicator. You keep the keys, review the output, and sign the assessment.

The rest of this guide explains what Claude Code actually is, why a coding agent suits CTI better than a chatbot, what you need to get started, and how the six categories of agent that make up a serious CTI deployment map onto skills you can run yourself.

What Claude Code is, and why a coding agent suits CTI

Claude Code is a coding agent that runs in your terminal. It was built to help engineers work on software, so it can read and write files, run commands, call external services, and chain those steps together towards a goal you give it in plain language. That last part is the important one for intelligence work. A chatbot answers the prompt in front of it. An agent can run a multi-step task on its own: fetch something, act on the result, fetch the next thing, and keep going until the job is done.

CTI is full of multi-step tasks. Enriching one indicator means querying several services and reconciling what they say. Profiling an actor means pulling reporting, extracting techniques, and mapping them to a framework. Drafting an assessment means doing all of that and then writing it up with the sourcing and confidence attached. A chatbot makes you the glue between every step, while an agent with tools is the glue itself.

The other reason a coding agent fits is skills. Claude Code can load reusable instruction sets, each one teaching it to do a specific job a specific way. That turns a general assistant into a set of specialists you can call by name, which is precisely how you build an intelligence capability rather than a clever summariser.

What you need to get started

Getting going is lighter than most people expect. You need three things.

The first is Claude Code itself, running against an Anthropic API key or a Claude subscription. The second is your own credentials for the services you already use: VirusTotal, Shodan, GreyNoise, AbuseIPDB, CrowdStrike, a MISP instance, whatever your programme runs on. Claude Code calls those services with your own keys, from your machine, so your integrations and credentials stay under your control rather than living inside someone else's product. The third is a set of CTI skills so the agent knows how a threat analyst works, not just how a developer works.

You do not have to write those skills from scratch. We put a pack of open-source CTI skills on GitHub under an MIT licence, covering investigation, enrichment, analytical tradecraft, threat-actor and campaign work, and detection engineering, and they run in Claude Code, Cursor, Codex, or any IDE that supports Agent Skills. You can browse the full set on our CTI Skills page. Loading them is what turns a coding agent into a CTI workstation.

Mapping the six agent categories onto Claude Code skills

A serious AI deployment for threat intelligence is not one model. It is a stack of specialised agents, each doing one job well, composed together on every event. Our guide to AI for threat intelligence sets out six categories. Here is how each one looks when you run it yourself in Claude Code.

Integration is the layer that calls external tools. With the right skills loaded, Claude Code enriches an IP or hash across VirusTotal, Shodan, GreyNoise and AbuseIPDB, pulls finished intelligence from a source like CrowdStrike, and reads from or writes back to your MISP or OpenCTI instance, all with your own keys.

Entity extraction pulls the structured signal out of unstructured reporting. Hand the agent a vendor blog or a forum post and the extraction skills lift the indicators of compromise, the MITRE ATT&CK techniques, the named actors and malware, and the sectors and regions in play, so a wall of prose becomes a set of records you can work with.

Tradecraft is the layer that separates analysis from summary, and it is where this approach earns its keep. The tradecraft skills run Analysis of Competing Hypotheses, rate how far both the source and its data can be trusted on the NATO Admiralty scale, attach calibrated confidence and likelihood language, and run a contrarian pass to surface disconfirming evidence. More on this below, because it is the part most coverage skips.

Knowledge is the self-maintaining picture of a topic. When you run a campaign-tracking or actor-profiling skill over time, the agent holds what is known about an actor or an ecosystem and places each new datapoint against it, so a fresh report is read in context rather than in isolation.

Organisation relevance is the judgement about whether any of this matters to you specifically. In the DIY setup this is where you stay closest to the loop, telling the agent what your organisation is, what it runs, and what it cares about, so the output is filtered to your threat profile rather than the whole firehose. The managed platform runs dedicated organisation agents for this continuously, which is one of the clearer lines between building it yourself and running it managed.

Production turns the finished analysis into the right artefact: a STIX bundle, a set of Sigma or YARA or KQL detections, a blocklist, or a written brief. Claude Code writes these to files you can drop straight into your tooling.

The point of the stack is that these are genuinely different jobs. Treating them as one undifferentiated lump of AI is how teams end up with a summariser and call it intelligence.

Composing them is the part you feel in daily use. In Claude Code you are the orchestrator at first, calling the skills in sequence and deciding what happens with each result, and you can hand more of that sequencing to the agent as you get comfortable; the managed platform takes the orchestration over entirely and runs it on every event. Nothing says the starting gun has to be you typing a prompt either: wire the same skills to a feed watcher or a mailbox and a fresh report kicks off the chain of enrichment, extraction, tradecraft, and production on its own.

Tradecraft is what separates this from pasting into ChatGPT

Anyone can paste a threat report into a chatbot and get a tidy summary back, but a summary is not intelligence, and the difference is in what happens to it next.

Intelligence is what you get when the raw material is put through the analytical discipline a good analyst would apply, every time. Run the ACH skill and the agent lays out the competing explanations for a piece of activity and tests the evidence against each, instead of anchoring on the first plausible read. Run the source-assessment skill before you onboard a feed and an unconfirmed forum post stays labelled as exactly that, rather than hardening into fact three reports later. Ask for calibrated confidence and the output tells your stakeholder how much weight the call can bear. And the devil's-advocate skill argues against your working theory on request, the step that gets skipped whenever the queue is long.

None of these techniques are new, and that is the point: the skills encode what analysts already know they should do. What changes is that the discipline no longer depends on how much time is left in the day. The same structured pass runs on the fiftieth indicator as on the first, and that consistency is the reason a stack of CTI skills is a different thing from a chat session.

One indicator, from inbox to assessment

Say a suspicious IP lands in your inbox. In a chat window you would copy it in and ask what is known, then copy each follow-up by hand. In Claude Code you give it one instruction and the agent runs the chain.

It enriches the IP across your configured services and reconciles the verdicts. It pivots from the IP to the domains and certificates that share infrastructure with it, expanding a single lead into the surrounding cluster. It rates each source it touched on the Admiralty scale, so the weak signals are flagged as weak. It checks the result against what your knowledge of the relevant actor already contains, noting that the hosting pattern fits a group you track. Then it drafts a short assessment with the indicators extracted, the technique mapped to ATT&CK, the confidence stated, and the sourcing attached, and writes a STIX bundle alongside it.

What took an afternoon of tab-switching becomes a few minutes of supervised work. You read the draft, sanity-check the call, and decide what to do with it. The agent did the legwork and the structuring, and the judgement stayed yours.

Where you, the analyst, stay in control

None of this hands the actual decisions to the machine; the skills build the scaffolding, and what gets decided on top of it is still yours.

Claude Code runs on your keys, on your stack, and produces output you review before anything leaves your hands. Think of the split as drafts versus decisions. Everything the agent produces, the hypothesis matrix, the source ratings, the assessment with its confidence attached, arrives as a draft for you to interrogate, and interrogating it is the job: you know when a conclusion smells wrong even though the formatting is immaculate, and you know which of three competing explanations fits what you saw in the last incident. When the assessment lands in front of your CISO, it lands with your name on it, not the model's. And your peers ring you, not your terminal, when something is moving. None of that changes because you moved the mechanical work to an agent. The agent is a force multiplier for the analyst you already are, not a substitute for one.

DIY with Claude Code, or run it managed

The build-it-yourself path is real, and we open-sourced the skills precisely so practitioners can take it. With Claude Code, your own keys, and the CTI skills pack, one analyst can run workflows that used to need a team, and learn a great deal about where AI helps in CTI by doing it.

The managed Liberty91 platform is for when you want the parts that are hard to maintain by hand running continuously and unattended: the self-maintaining knowledge agents that keep a current picture of every topic you track, and the organisation agents that judge relevance to your business on every event, all running against your intelligence requirements without you tending the plumbing. And if what you actually want is the outcome, an analyst function that runs continuously without you assembling it, our AI threat intelligence analyst page describes that.

Either way the principle is the same one that runs through the whole intelligence lifecycle: AI carries the collection, processing, and analytical scaffolding so the analyst gets the time back for the judgement that actually protects the organisation. Claude Code is simply the most direct way to put your hands on that today.