diff --git a/cluster/threat-actor.json b/cluster/threat-actor.json
index 70d49dd..77e0b3f 100644
--- a/cluster/threat-actor.json
+++ b/cluster/threat-actor.json
@@ -2,5 +2,5 @@
    "name" : "threat actor",
    "description": "threat actor cluster",
    "version": 1,
-   "elementOneOf": ["adversary-groups", "threat-actor-intended-effect-vocabulary", "planning-and-operational-support-vocabulary", "threat-actor-motivation-vocabulary", "threat-actor-type-vocabulary", "threat-actor-sophistication-vocabulary", "certainty-level"]
+   "elementOneOf": ["adversary-groups", "threat-actor-intended-effect-vocabulary", "planning-and-operational-support-vocabulary", "threat-actor-motivation-vocabulary", "threat-actor-type-vocabulary", "threat-actor-sophistication-vocabulary", "certainty-level", "threat-actor-tools"]
 }