Threat Actor Footprint

const SIXTYFOUR_API_KEY = process.env.SIXTYFOUR_API_KEY;

async function mapThreatActorFootprint({ fullName, email, linkedinUrl }) {
  const response = await fetch("https://api.sixtyfour.ai/people-intelligence", {
    method: "POST",
    headers: {
      "x-api-key": SIXTYFOUR_API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      lead_info: {
        full_name: fullName,
        ...(email && { email }),
        ...(linkedinUrl && { linkedin_url: linkedinUrl }),
      },
      struct: {
        full_name: "Confirmed full legal name",
        known_aliases:
          "Other names, handles, or usernames. 'None found' if absent.",
        confirmed_emails: "Known email addresses, comma-separated. 'None found' if absent.",
        confirmed_phone_numbers: "Known phone numbers, comma-separated. 'None found' if absent.",
        social_profiles:
          "Confirmed profiles (LinkedIn, Twitter/X, GitHub, etc.). Format: 'Platform: URL'. 'None found' if absent.",
        professional_background:
          "Current and recent employers, roles, and tenure — one line each.",
        technical_skills:
          "Programming languages, security tools, or technical domains. 'None found' if unidentifiable.",
        forum_and_community_presence:
          "Activity on HN, Reddit, Stack Overflow, security forums, etc. 'None found' if absent.",
        dark_web_mentions:
          "Mentions on dark web forums, paste sites, or underground markets. 'None found' if absent.",
        credential_leak_exposure:
          "Appearances in known data breaches. Cite source/date if known. 'None found' if absent.",
        domain_and_infrastructure:
          "Domains or IPs registered to or associated with this person. 'None found' if absent.",
        threat_actor_signals:
          "Associations with threat groups, CVE authorship, or public attribution. 'None found' if absent.",
        legal_and_public_record:
          "Court records, regulatory actions, law enforcement mentions. 'None found' if absent.",
        risk_score:
          "Integer 0-100. 0 = no signals, 100 = confirmed high-risk actor.",
        risk_verdict: "One of: none | low | medium | high | critical",
        risk_summary: "3-5 sentences on key findings and basis for verdict.",
        data_sources_note: "OSINT databases, breach indices, social platforms used. Note any gaps.",
      },
      tier: "low",
    }),
  });

  if (!response.ok) {
    const body = await response.text();
    throw new Error(`Sixtyfour API error ${response.status}: ${body}`);
  }

  const { structured_data, confidence_score, references } = await response.json();
  return { structured_data, confidence_score, references };
}

// Example usage
const { structured_data } = await mapThreatActorFootprint({
  fullName: "Saarth Shah",
  email: "saarth@sixtyfour.ai",
  linkedinUrl: "https://linkedin.com/in/saarthshah",
});
console.log(`${structured_data.full_name} — risk: ${structured_data.risk_verdict} (${structured_data.risk_score}/100)`);
console.log(structured_data.risk_summary);