# config/sources.d/42-cybersecurity.yaml — cybersecurity coverage (2026-09-11): CVE/KEV/EPSS feeds, vendor PSIRT
# advisories, national CERTs, exploit & ransomware trackers, threat-intel research blogs, supply-chain / dependency
# vulnerability databases, security tooling releases and security media. Extends the founding cyber block (cisa, nvd,
# nist, cert-cc, mitre, microsoft-security, …) and earlier fragments; every URL below was fetched and parsed on
# 2026-09-11. Blocked / JS-only pages (Oracle CPU, Adobe PSIRT, Broadcom/VMware advisories, Citrix bulletins, SonicWall
# PSIRT, Juniper, F5 MyF5, Akamai blog RSS, Trellix, BSI RSS, ENISA news RSS, ACSC, Shadowserver, Packet Storm TOS wall,
# CVE.org list API, OSV POST API, VulnCheck auth) are recorded in `notes:` instead of pretending.
sources:
  # ───────────────────────── A · US government, CVE ecosystem, scoring ─────────────────────────
  - id: cisa
    extend: true
    country: US
    aliases: [us-cert, ics-cert, cisa kev]
    products:
      - { name: ICS Advisories, type: service, aliases: [ics-cert advisories, icsa] }
      - { name: Vulnrichment, type: dataset, aliases: [cisa vulnrichment, ssvc] }
    sensors:
      - { name: ics advisories feed, url: "https://www.cisa.gov/cybersecurity-advisories/ics-advisories.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 60 } }
      - { name: ics medical advisories feed, url: "https://www.cisa.gov/cybersecurity-advisories/ics-medical-advisories.xml", type: RSS, connector: rss, tier: B }
      - { name: alerts feed, url: "https://www.cisa.gov/cybersecurity-advisories/alerts.xml", type: RSS, connector: rss, tier: S }
      - { name: cybersecurity advisories feed, url: "https://www.cisa.gov/cybersecurity-advisories/cybersecurity-advisories.xml", type: RSS, connector: rss, tier: A }
      - { name: analysis reports feed, url: "https://www.cisa.gov/cybersecurity-advisories/analysis-reports.xml", type: RSS, connector: rss, tier: B }
      - { name: blog feed, url: "https://www.cisa.gov/blog.xml", type: RSS, connector: rss, tier: C }
      - { name: vulnrichment commits, url: "https://github.com/cisagov/vulnrichment/commits/develop.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: cisagov/vulnrichment, kind: commits, branch: develop } }
      - { name: scubagear releases, url: "https://github.com/cisagov/ScubaGear/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: cisagov/ScubaGear, kind: releases } }
  - id: nvd
    extend: true
    country: US
    llm: false
    sensors:
      - name: newly published cves
        url: "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate={now-2h}&pubEndDate={now}&resultsPerPage=200"
        type: REST_API
        connector: jsonlist
        tier: A
        interval: 900
        config: { itemsPath: vulnerabilities, keyField: cve.id, titleTemplate: "{cve.id} — {cve.vulnStatus} ({cve.sourceIdentifier})", summaryField: cve.descriptions, dateField: cve.published, urlTemplate: "https://nvd.nist.gov/vuln/detail/{key}", compareFields: [cve.vulnStatus, cve.metrics], noConditional: true, maxItems: 200 }
  - id: nist
    extend: true
    country: US
    sensors:
      - { name: cybersecurity insights blog, url: "https://www.nist.gov/blogs/cybersecurity-insights/rss.xml", type: RSS, connector: rss, tier: C }
  - id: cert-cc
    extend: true
    country: US
    sensors:
      - { name: vulnerability notes atom, url: "https://www.kb.cert.org/vuls/atomfeed/", type: ATOM, connector: rss, tier: A }
  - id: mitre
    extend: true
    country: US
    products:
      - { name: CVE Program, type: service, aliases: [cve.org, cve list, cna] }
      - { name: ATT&CK, type: dataset, aliases: [mitre att&ck, attack framework] }
      - { name: CWE, type: dataset, aliases: [common weakness enumeration] }
    notes: "CVE.org list API (cveawg.mitre.org/api/cve-id) requires CNA credentials → not a sensor; mitre.org RSS returns 403 (Akamai)."
    sensors:
      - { name: cve program blog, url: "https://medium.com/feed/@cve_program", type: RSS, connector: rss, tier: C }
      - { name: attack blog, url: "https://medium.com/feed/mitre-attack", type: RSS, connector: rss, tier: C }
      - { name: cti stix releases, url: "https://github.com/mitre/cti/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: mitre/cti, kind: releases } }
      - { name: cve schema releases, url: "https://github.com/CVEProject/cve-schema/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: CVEProject/cve-schema, kind: releases } }
      - { name: attack navigator releases, url: "https://github.com/mitre-attack/attack-navigator/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: mitre-attack/attack-navigator, kind: releases } }
      - { name: attack flow releases, url: "https://github.com/center-for-threat-informed-defense/attack-flow/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: center-for-threat-informed-defense/attack-flow, kind: releases } }
  - id: first-org
    extend: true
    country: US
    products:
      - { name: EPSS, type: dataset, aliases: [exploit prediction scoring system, epss score] }
    sensors:
      - { name: epss scores updated today, url: "https://api.first.org/data/v1/epss?days=1&limit=100", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: data, keyField: cve, titleTemplate: "{cve} — EPSS {epss} (percentile {percentile})", dateField: date, urlTemplate: "https://nvd.nist.gov/vuln/detail/{key}", compareFields: [epss, percentile], maxItems: 100 } }
      - { name: epss top scores, url: "https://api.first.org/data/v1/epss?epss-gt=0.9&order=!date&limit=100", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: data, keyField: cve, titleTemplate: "{cve} — EPSS {epss}", dateField: date, urlTemplate: "https://nvd.nist.gov/vuln/detail/{key}", compareFields: [epss], maxItems: 100 } }
      - { name: press releases, url: "https://www.first.org/newsroom/releases/rss.xml", type: RSS, connector: rss, tier: C }
  - id: ic3
    name: FBI Internet Crime Complaint Center
    domain: ic3.gov
    homepage: https://www.ic3.gov
    categories: [cyber, government]
    tier: A
    country: US
    aliases: [ic3, fbi ic3, internet crime complaint center]
    discover: { rss: false }
    sensors:
      - { name: public service announcements, url: "https://www.ic3.gov/PSA/RSS", type: RSS, connector: rss, tier: A }
      - { name: cybersecurity advisories, url: "https://www.ic3.gov/CSA/RSS", type: RSS, connector: rss, tier: A }
  - id: circl
    name: CIRCL (Computer Incident Response Center Luxembourg)
    domain: circl.lu
    homepage: https://www.circl.lu
    categories: [cyber, government]
    tier: B
    country: LU
    aliases: [circl, vulnerability-lookup, cve-search]
    products:
      - { name: Vulnerability-Lookup, type: service, aliases: [vulnerability.circl.lu] }
      - { name: MISP, type: software, aliases: [misp project, malware information sharing platform] }
    discover: { rss: false }
    sensors:
      - { name: news feed, url: "https://www.circl.lu/rss.xml", type: RSS, connector: rss, tier: C }
      - { name: latest vulnerabilities (vulnerability-lookup), url: "https://cve.circl.lu/api/last/30", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: "", keyField: id, titleTemplate: "{id}", summaryField: details, dateField: published, urlTemplate: "https://vulnerability.circl.lu/vuln/{key}", compareFields: [modified], maxItems: 30 } }
      - { name: misp releases, url: "https://github.com/MISP/MISP/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: MISP/MISP, kind: releases } }

  # ───────────────────────── B · Platform vendors: advisories & security blogs ─────────────────────────
  - id: microsoft-security
    extend: true
    country: US
    products:
      - { name: Security Update Guide, type: service, aliases: [msrc update guide, patch tuesday, msrc cvrf] }
      - { name: Microsoft Threat Intelligence, type: service, aliases: [mstic, microsoft threat intelligence center] }
    sensors:
      - { name: security update guide feed, url: "https://api.msrc.microsoft.com/update-guide/rss", type: RSS, connector: rss, tier: S, config: { maxItems: 200 } }
      - { name: security blog feed, url: "https://www.microsoft.com/en-us/security/blog/feed/", type: RSS, connector: rss, tier: B }
      - { name: threat intelligence blog feed, url: "https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed/", type: RSS, connector: rss, tier: A }
  - id: apple-security
    extend: true
    country: US
    sensors:
      - { name: security research blog, url: "https://security.apple.com/blog/", type: HTML, connector: http, tier: C }
  - id: android
    name: Android Security
    domain: source.android.com
    homepage: https://source.android.com/docs/security
    categories: [cyber, consumer-tech]
    tier: A
    country: US
    aliases: [android security bulletin, android open source project security, aosp security]
    discover: { rss: false }
    sensors:
      - { name: security bulletins index, url: "https://source.android.com/docs/security/bulletin", type: HTML, connector: http, tier: A }
  - id: chromium
    extend: true
    country: US
    sensors:
      - { name: chrome stable channel updates, url: "https://chromereleases.googleblog.com/feeds/posts/default/-/Stable%20updates", type: ATOM, connector: rss, tier: A }
  - id: google
    extend: true
    sensors:
      - { name: safety & security blog, url: "https://blog.google/technology/safety-security/rss/", type: RSS, connector: rss, tier: B }
  - id: google-cloud
    extend: true
    products:
      - { name: Google Cloud Security Bulletins, type: service, aliases: [gcp security bulletins, gke security bulletins] }
    sensors:
      - { name: security bulletins feed, url: "https://cloud.google.com/feeds/google-cloud-security-bulletins.xml", type: ATOM, connector: rss, tier: A }
      - { name: gke security bulletins feed, url: "https://cloud.google.com/feeds/gke-security-bulletins.xml", type: ATOM, connector: rss, tier: A }
      - { name: identity & security blog, url: "https://cloudblog.withgoogle.com/products/identity-security/rss/", type: RSS, connector: rss, tier: C }
  - id: aws
    extend: true
    sensors:
      - { name: security blog feed, url: "https://aws.amazon.com/blogs/security/feed/", type: RSS, connector: rss, tier: B }
  - id: cisco-security
    extend: true
    country: US
    products:
      - { name: Cisco Talos, type: service, aliases: [talos, talos intelligence] }
    sensors:
      - { name: event responses feed, url: "https://sec.cloudapps.cisco.com/security/center/eventResponses_20.xml", type: RSS, connector: rss, tier: A }
      - { name: talos blog feed, url: "https://blog.talosintelligence.com/rss/", type: RSS, connector: rss, tier: B }
      - { name: cisco security blog feed, url: "https://blogs.cisco.com/security/feed", type: RSS, connector: rss, tier: C }
  - id: palo-alto-networks
    extend: true
    country: US
    sensors:
      - { name: corporate blog feed, url: "https://www.paloaltonetworks.com/blog/feed/", type: RSS, connector: rss, tier: C }
  - id: fortinet
    extend: true
    country: US
    products:
      - { name: FortiGuard Outbreak Alerts, type: service, aliases: [outbreak alerts] }
    notes: "fortinet.com blog RSS paths return 404; feeds.fortinet.com does not resolve."
    sensors:
      - { name: outbreak alerts feed, url: "https://filestore.fortinet.com/fortiguard/rss/outbreakalert.xml", type: RSS, connector: rss, tier: A }
  - id: sentinelone
    extend: true
    country: US
    products:
      - { name: SentinelLabs, type: service, aliases: [sentinel labs] }
    sensors:
      - { name: sentinellabs feed, url: "https://www.sentinelone.com/labs/feed/", type: RSS, connector: rss, tier: B }
  - id: sophos
    extend: true
    country: GB
    products:
      - { name: Sophos X-Ops, type: service, aliases: [x-ops, sophoslabs] }
    sensors:
      - { name: threat research feed, url: "https://www.sophos.com/en-us/category/threat-research/feed", type: RSS, connector: rss, tier: B }
  - id: trend-micro
    extend: true
    country: JP
    notes: "trendmicro.com research RSS paths return 404; FeedBurner security-news feed still served."
    sensors:
      - { name: security news feed, url: "https://feeds.feedburner.com/TrendMicroSecurityNews", type: RSS, connector: rss, tier: B }
  - id: zero-day-initiative
    name: Zero Day Initiative
    domain: zerodayinitiative.com
    homepage: https://www.zerodayinitiative.com
    categories: [cyber]
    tier: A
    country: US
    aliases: [zdi, trend micro zdi, pwn2own]
    llm: false
    discover: { rss: false }
    sensors:
      - { name: published advisories feed, url: "https://www.zerodayinitiative.com/rss/published/", type: RSS, connector: rss, tier: A, config: { maxItems: 100 } }
      - { name: upcoming advisories feed, url: "https://www.zerodayinitiative.com/rss/upcoming/", type: RSS, connector: rss, tier: B, config: { maxItems: 100 } }
      - { name: blog feed, url: "https://www.zerodayinitiative.com/blog?format=rss", type: RSS, connector: rss, tier: C }
  - id: tenable
    extend: true
    country: US
    sensors:
      - { name: cyber exposure alerts feed, url: "https://www.tenable.com/blog/cyber-exposure-alerts/feed", type: RSS, connector: rss, tier: A }
      - { name: product security advisories feed, url: "https://www.tenable.com/security/feed", type: RSS, connector: rss, tier: B }
  - id: rapid7
    extend: true
    country: US
    sensors:
      - { name: emergent threat response feed, url: "https://www.rapid7.com/blog/tag/emergent-threat-response/rss/", type: RSS, connector: rss, tier: A }
  - id: crowdstrike
    extend: true
    country: US
  - id: mandiant
    extend: true
    country: US
  - id: malwarebytes
    extend: true
    country: US
  - id: ivanti
    extend: true
    country: US
    sensors:
      - { name: security advisory blog feed, url: "https://www.ivanti.com/blog/topics/security-advisory/rss", type: RSS, connector: rss, tier: A }
  - id: broadcom
    extend: true
    categories: [cyber]
    notes: "VMware security advisories moved to support.broadcom.com (JS-rendered) → no advisories sensor; VMware security blog RSS kept."
    sensors:
      - { name: vmware security blog feed, url: "https://blogs.vmware.com/security/feed", type: RSS, connector: rss, tier: B }
  - id: atlassian
    extend: true
    categories: [cyber]
    sensors:
      - { name: security advisories space feed, url: "https://confluence.atlassian.com/createrssfeed.action?types=page&spaces=SECURITY&title=Security+Advisories&labelString=&excludedSpaceKeys=&sort=modified&maxResults=25&timeSpan=600&showContent=true&confirm=Create+RSS+Feed", type: ATOM, connector: rss, tier: A }
  - id: yubico
    name: Yubico
    domain: yubico.com
    homepage: https://www.yubico.com
    categories: [cyber, consumer-tech]
    tier: B
    country: SE
    aliases: [yubikey]
    discover: { rss: true }
    sensors:
      - { name: blog feed, url: "https://www.yubico.com/feed/", type: RSS, connector: rss, tier: C }
  - id: jamf
    name: Jamf
    domain: jamf.com
    homepage: https://www.jamf.com
    categories: [cyber, enterprise]
    tier: C
    country: US
    aliases: [jamf threat labs]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.jamf.com/blog/rss/", type: RSS, connector: rss, tier: C }
  - id: hashicorp
    extend: true
    sensors:
      - { name: security announcements forum, url: "https://discuss.hashicorp.com/c/security/52.rss", type: RSS, connector: rss, tier: A }
  - id: mongodb
    extend: true
    categories: [cyber]
    sensors:
      - { name: server security issues (jira), url: "https://jira.mongodb.org/sr/jira.issueviews:searchrequest-rss/temp/SearchRequest.xml?jqlQuery=project+%3D+SERVER+AND+labels+%3D+security&tempMax=50", type: RSS, connector: rss, tier: B }
  - id: postgresql
    extend: true
    categories: [cyber]
    sensors:
      - { name: security information page, url: "https://www.postgresql.org/support/security/", type: HTML, connector: http, tier: B }

  # ───────────────────────── C · Source code platforms, Linux, language ecosystems (dependency vulnerabilities) ─────────────────────────
  - id: github
    extend: true
    categories: [cyber]
    products:
      - { name: GitHub Advisory Database, type: dataset, aliases: [ghsa, github advisories, advisory database] }
      - { name: GitHub Security Lab, type: service, aliases: [security lab] }
    sensors:
      - { name: advisory database (all ecosystems), url: "https://api.github.com/advisories?per_page=100&sort=published", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, summaryField: description, dateField: published_at, compareFields: [severity, updated_at, withdrawn_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories npm, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=npm", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories pypi, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=pip", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories maven, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=maven", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories go, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=go", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories rubygems, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=rubygems", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories rust crates, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=rust", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories composer, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=composer", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: advisories nuget, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=nuget", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }
      - { name: critical advisories, url: "https://api.github.com/advisories?per_page=50&sort=published&severity=critical", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — CRITICAL: {summary}", urlField: html_url, summaryField: description, dateField: published_at, compareFields: [updated_at, withdrawn_at], maxItems: 50, headers: { accept: application/vnd.github+json } } }
      - { name: security lab advisories feed, url: "https://securitylab.github.com/advisories/feed.xml", type: RSS, connector: rss, tier: B }
      - { name: vulnerability research blog feed, url: "https://github.blog/security/vulnerability-research/feed/", type: RSS, connector: rss, tier: C }
      - { name: advisory database commits, url: "https://github.com/github/advisory-database/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: github/advisory-database, kind: commits, branch: main } }
  - id: gitlab
    extend: true
    categories: [cyber]
    sensors:
      - { name: patch & security releases feed, url: "https://docs.gitlab.com/releases/patch-releases.xml", type: ATOM, connector: rss, tier: A, config: { maxItems: 50 } }
  - id: kubernetes
    extend: true
    categories: [cyber]
    products:
      - { name: Kubernetes Official CVE Feed, type: dataset, aliases: [k8s cve feed] }
    sensors:
      - { name: official cve feed, url: "https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json", type: JSON, connector: jsonlist, tier: A, config: { itemsPath: items, keyField: id, titleField: summary, urlField: url, summaryField: content_text, dateField: date_published, compareFields: [status, summary], maxItems: 200 } }
  - id: docker
    extend: true
    categories: [cyber]
    sensors:
      - { name: security blog category feed, url: "https://www.docker.com/blog/category/security/feed/", type: RSS, connector: rss, tier: C }
  - id: red-hat
    extend: true
    categories: [cyber]
    products:
      - { name: Red Hat Product Security, type: service, aliases: [rhsa, red hat security advisories, red hat security data api] }
    notes: "securitydata/cve.json returns a JSON-encoded string (double-encoded) → not parseable by jsonlist; csaf.json is a proper array."
    sensors:
      - { name: security advisories (csaf api), url: "https://access.redhat.com/hydra/rest/securitydata/csaf.json?per_page=100", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: RHSA, titleTemplate: "{RHSA} — {severity}: {CVEs}", urlField: resource_url, dateField: released_on, compareFields: [severity, released_on], maxItems: 100 } }
      - { name: security blog channel feed, url: "https://www.redhat.com/en/rss/blog/channel/security", type: RSS, connector: rss, tier: C }
  - id: suse
    extend: true
    categories: [cyber]
    sensors:
      - { name: security blog tag feed, url: "https://www.suse.com/c/tag/security/feed/", type: RSS, connector: rss, tier: C }
  - id: gentoo
    name: Gentoo Linux
    domain: gentoo.org
    homepage: https://www.gentoo.org
    categories: [open-source, cyber, developer]
    tier: B
    country: US
    aliases: [gentoo, glsa, gentoo linux security advisories]
    discover: { rss: false }
    sensors:
      - { name: glsa feed, url: "https://security.gentoo.org/glsa/feed.rss", type: RSS, connector: rss, tier: A }
  - id: linux-kernel
    extend: true
    categories: [cyber]
    products:
      - { name: Linux kernel CVE team, type: service, aliases: [linux-cve-announce, kernel cve] }
    sensors:
      - { name: linux-cve-announce feed, url: "https://lore.kernel.org/linux-cve-announce/new.atom", type: ATOM, connector: rss, tier: A, config: { maxItems: 100 } }
  - id: openssl
    extend: true
    sensors:
      - { name: vulnerabilities page, url: "https://openssl-library.org/news/vulnerabilities/", type: HTML, connector: http, tier: A }
  - id: python
    extend: true
    categories: [cyber]
    sensors:
      - { name: psf advisory database commits, url: "https://github.com/psf/advisory-database/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: psf/advisory-database, kind: commits, branch: main } }
      - { name: pypa advisory database commits, url: "https://github.com/pypa/advisory-database/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: pypa/advisory-database, kind: commits, branch: main } }
  - id: go
    extend: true
    categories: [cyber]
    products:
      - { name: Go Vulnerability Database, type: dataset, aliases: [govulndb, vuln.go.dev, govulncheck] }
    sensors:
      - { name: vulnerability database index, url: "https://vuln.go.dev/index/vulns.json", type: JSON, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — {aliases}", dateField: modified, urlTemplate: "https://pkg.go.dev/vuln/{key}", compareFields: [modified], maxItems: 10000 } }
  - id: rust
    extend: true
    categories: [cyber]
    products:
      - { name: RustSec Advisory Database, type: dataset, aliases: [rustsec, cargo-audit] }
    sensors:
      - { name: rustsec advisories feed, url: "https://rustsec.org/feed.xml", type: ATOM, connector: rss, tier: A }
      - { name: rustsec advisory-db commits, url: "https://github.com/rustsec/advisory-db/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: rustsec/advisory-db, kind: commits, branch: main } }
  - id: ruby
    extend: true
    categories: [cyber]
    sensors:
      - { name: ruby advisory database commits, url: "https://github.com/rubysec/ruby-advisory-db/commits/master.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: rubysec/ruby-advisory-db, kind: commits, branch: master } }
  - id: php
    extend: true
    categories: [cyber]
    sensors:
      - { name: friendsofphp security advisories commits, url: "https://github.com/FriendsOfPHP/security-advisories/commits/master.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: FriendsOfPHP/security-advisories, kind: commits, branch: master } }
  - id: nodejs
    extend: true
    categories: [cyber]
    sensors:
      - { name: security working group commits, url: "https://github.com/nodejs/security-wg/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: nodejs/security-wg, kind: commits, branch: main } }
  - id: wordpress
    extend: true
    categories: [cyber]
    sensors:
      - { name: security news feed, url: "https://wordpress.org/news/category/security/feed/", type: RSS, connector: rss, tier: A }
  - id: wordfence
    name: Wordfence
    domain: wordfence.com
    homepage: https://www.wordfence.com
    categories: [cyber, internet]
    tier: B
    country: US
    aliases: [defiant, wordfence threat intelligence]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.wordfence.com/blog/feed/", type: RSS, connector: rss, tier: B }
  - id: patchstack
    name: Patchstack
    domain: patchstack.com
    homepage: https://patchstack.com
    categories: [cyber, internet]
    tier: B
    country: EE
    discover: { rss: false }
    sensors:
      - { name: articles feed, url: "https://patchstack.com/feed/", type: RSS, connector: rss, tier: B }
  - id: wpscan
    name: WPScan
    domain: wpscan.com
    homepage: https://wpscan.com
    categories: [cyber, internet]
    tier: C
    country: GB
    aliases: [wpscan vulnerability database]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://wpscan.com/blog/feed/", type: RSS, connector: rss, tier: C }
  - id: sucuri
    name: Sucuri
    domain: sucuri.net
    homepage: https://sucuri.net
    categories: [cyber, internet]
    tier: C
    country: US
    aliases: [sucuri labs]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.sucuri.net/feed", type: RSS, connector: rss, tier: C }

  # ───────────────────────── D · Supply-chain security, SBOM/VEX standards, security tooling ─────────────────────────
  - id: openssf
    extend: true
    products:
      - { name: OpenSSF Scorecard, type: software, aliases: [scorecard] }
      - { name: OSV Schema, type: standard, aliases: [osv schema, open source vulnerability schema] }
    sensors:
      - { name: scorecard releases, url: "https://github.com/ossf/scorecard/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: ossf/scorecard, kind: releases } }
      - { name: osv schema releases, url: "https://github.com/ossf/osv-schema/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: ossf/osv-schema, kind: releases } }
  - id: osv
    name: OSV.dev
    domain: osv.dev
    homepage: https://osv.dev
    categories: [cyber, open-source, developer]
    tier: B
    country: US
    aliases: [open source vulnerabilities, osv scanner, google osv]
    notes: "The OSV query API is POST-only → no jsonlist sensor; release feed of the scanner used instead."
    discover: { rss: false }
    sensors:
      - { name: osv-scanner releases, url: "https://github.com/google/osv-scanner/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: google/osv-scanner, kind: releases } }
  - id: sigstore
    name: Sigstore
    domain: sigstore.dev
    homepage: https://www.sigstore.dev
    categories: [cyber, open-source, developer]
    tier: C
    country: US
    aliases: [cosign, fulcio, rekor]
    discover: { rss: false }
    sensors:
      - { name: cosign releases, url: "https://github.com/sigstore/cosign/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: sigstore/cosign, kind: releases } }
  - id: chainguard
    name: Chainguard
    domain: chainguard.dev
    homepage: https://www.chainguard.dev
    categories: [cyber, developer, cloud]
    tier: C
    country: US
    aliases: [wolfi, chainguard images]
    discover: { rss: false }
    sensors:
      - { name: unchained blog feed, url: "https://www.chainguard.dev/unchained/rss.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }
      - { name: wolfi os commits, url: "https://github.com/wolfi-dev/os/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: wolfi-dev/os, kind: commits, branch: main } }
      - { name: melange releases, url: "https://github.com/chainguard-dev/melange/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: chainguard-dev/melange, kind: releases } }
  - id: aqua-security
    name: Aqua Security
    domain: aquasec.com
    homepage: https://www.aquasec.com
    categories: [cyber, cloud, developer]
    tier: C
    country: IL
    aliases: [aqua nautilus, trivy]
    products:
      - { name: Trivy, type: software, aliases: [trivy scanner] }
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.aquasec.com/rss.xml", type: RSS, connector: rss, tier: C }
      - { name: trivy releases, url: "https://github.com/aquasecurity/trivy/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: aquasecurity/trivy, kind: releases } }
  - id: anchore
    name: Anchore
    domain: anchore.com
    homepage: https://anchore.com
    categories: [cyber, developer]
    tier: D
    country: US
    aliases: [grype, syft]
    discover: { rss: true }
    sensors:
      - { name: grype releases, url: "https://github.com/anchore/grype/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: anchore/grype, kind: releases } }
      - { name: syft releases, url: "https://github.com/anchore/syft/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: anchore/syft, kind: releases } }
  - id: cyclonedx
    name: OWASP CycloneDX
    domain: cyclonedx.org
    homepage: https://cyclonedx.org
    categories: [cyber, standards, open-source]
    tier: D
    country: US
    aliases: [cyclonedx, sbom standard]
    discover: { rss: false }
    sensors:
      - { name: specification releases, url: "https://github.com/CycloneDX/specification/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: CycloneDX/specification, kind: releases } }
  - id: spdx
    name: SPDX
    domain: spdx.dev
    homepage: https://spdx.dev
    categories: [cyber, standards, open-source]
    tier: D
    country: US
    aliases: [software package data exchange]
    discover: { rss: false }
    sensors:
      - { name: specification releases, url: "https://github.com/spdx/spdx-spec/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: spdx/spdx-spec, kind: releases } }
  - id: oasis-csaf
    name: OASIS CSAF
    domain: oasis-open.org
    homepage: https://oasis-open.github.io/csaf-documentation/
    categories: [cyber, standards]
    tier: D
    country: US
    aliases: [csaf, common security advisory framework]
    discover: { rss: false }
    sensors:
      - { name: csaf releases, url: "https://github.com/oasis-tcs/csaf/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: oasis-tcs/csaf, kind: releases } }
  - id: openvex
    name: OpenVEX
    domain: openvex.dev
    homepage: https://openvex.dev
    categories: [cyber, standards, open-source]
    tier: D
    country: US
    aliases: [vex, vulnerability exploitability exchange]
    discover: { rss: false }
    sensors:
      - { name: vexctl releases, url: "https://github.com/openvex/vexctl/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: openvex/vexctl, kind: releases } }
  - id: projectdiscovery
    name: ProjectDiscovery
    domain: projectdiscovery.io
    homepage: https://projectdiscovery.io
    categories: [cyber, open-source, developer]
    tier: B
    country: US
    aliases: [nuclei, nuclei templates]
    discover: { rss: false }
    sensors:
      - { name: nuclei releases, url: "https://github.com/projectdiscovery/nuclei/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: projectdiscovery/nuclei, kind: releases } }
      - { name: nuclei templates releases, url: "https://github.com/projectdiscovery/nuclei-templates/releases.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: projectdiscovery/nuclei-templates, kind: releases } }
  - id: owasp
    extend: true
    products:
      - { name: OWASP ZAP, type: software, aliases: [zap, zed attack proxy] }
    sensors:
      - { name: zap releases, url: "https://github.com/zaproxy/zaproxy/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: zaproxy/zaproxy, kind: releases } }
  - id: semgrep
    name: Semgrep
    domain: semgrep.dev
    homepage: https://semgrep.dev
    categories: [cyber, developer]
    tier: D
    country: US
    discover: { rss: true }
    sensors:
      - { name: releases, url: "https://github.com/semgrep/semgrep/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: semgrep/semgrep, kind: releases } }
  - id: truffle-security
    name: Truffle Security
    domain: trufflesecurity.com
    homepage: https://trufflesecurity.com
    categories: [cyber, developer]
    tier: D
    country: US
    aliases: [trufflehog]
    discover: { rss: true }
    sensors:
      - { name: trufflehog releases, url: "https://github.com/trufflesecurity/trufflehog/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: trufflesecurity/trufflehog, kind: releases } }
  - id: gitleaks
    name: Gitleaks
    domain: gitleaks.io
    homepage: https://gitleaks.io
    categories: [cyber, developer, open-source]
    tier: D
    country: US
    discover: { rss: false }
    sensors:
      - { name: releases, url: "https://github.com/gitleaks/gitleaks/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: gitleaks/gitleaks, kind: releases } }
  - id: wazuh
    name: Wazuh
    domain: wazuh.com
    homepage: https://wazuh.com
    categories: [cyber, open-source]
    tier: D
    country: US
    discover: { rss: true }
    sensors:
      - { name: releases, url: "https://github.com/wazuh/wazuh/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: wazuh/wazuh, kind: releases } }
  - id: osquery
    name: osquery
    domain: osquery.io
    homepage: https://osquery.io
    categories: [cyber, open-source]
    tier: D
    country: US
    discover: { rss: false }
    sensors:
      - { name: releases, url: "https://github.com/osquery/osquery/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: osquery/osquery, kind: releases } }
  - id: falco
    name: Falco
    domain: falco.org
    homepage: https://falco.org
    categories: [cyber, open-source, cloud]
    tier: D
    country: US
    aliases: [falcosecurity]
    discover: { rss: true }
    sensors:
      - { name: releases, url: "https://github.com/falcosecurity/falco/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: falcosecurity/falco, kind: releases } }
  - id: filigran
    name: Filigran (OpenCTI)
    domain: filigran.io
    homepage: https://filigran.io
    categories: [cyber, open-source]
    tier: D
    country: FR
    aliases: [opencti, openbas]
    discover: { rss: true }
    sensors:
      - { name: opencti releases, url: "https://github.com/OpenCTI-Platform/opencti/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: OpenCTI-Platform/opencti, kind: releases } }
  - id: sigmahq
    name: SigmaHQ
    domain: sigmahq.io
    homepage: https://sigmahq.io
    categories: [cyber, open-source]
    tier: D
    country: DE
    aliases: [sigma rules]
    discover: { rss: false }
    sensors:
      - { name: sigma releases, url: "https://github.com/SigmaHQ/sigma/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: SigmaHQ/sigma, kind: releases } }
  - id: virustotal
    name: VirusTotal
    domain: virustotal.com
    homepage: https://www.virustotal.com
    categories: [cyber]
    tier: C
    country: US
    aliases: [yara]
    products:
      - { name: YARA, type: software, aliases: [yara rules engine] }
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.virustotal.com/feeds/posts/default", type: ATOM, connector: rss, tier: C }
      - { name: yara releases, url: "https://github.com/VirusTotal/yara/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: VirusTotal/yara, kind: releases } }
  - id: hibp
    extend: true
    country: AU
    aliases: [pwned, haveibeenpwned]
  - id: exploit-db
    name: Exploit Database
    domain: exploit-db.com
    homepage: https://www.exploit-db.com
    categories: [cyber]
    tier: A
    country: US
    aliases: [exploit-db, exploitdb, offsec exploit database]
    llm: false
    discover: { rss: false }
    sensors:
      - { name: latest exploits feed, url: "https://www.exploit-db.com/rss.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 50 } }
      - { name: exploitdb repository commits, url: "https://gitlab.com/exploit-database/exploitdb/-/commits/main?format=atom", type: ATOM, connector: rss, tier: B, config: { maxItems: 40 } }
  - id: ransomware-live
    name: ransomware.live
    domain: ransomware.live
    homepage: https://www.ransomware.live
    categories: [cyber]
    tier: A
    country: FR
    aliases: [ransomware live, ransomware victims tracker]
    llm: false
    discover: { rss: false }
    sensors:
      - { name: recent victims api, url: "https://api.ransomware.live/v2/recentvictims", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: victim, titleTemplate: "{group} — {victim} ({country})", urlField: url, summaryField: description, dateField: discovered, compareFields: [group, attackdate, ransom], maxItems: 100 } }
      - { name: victims feed, url: "https://www.ransomware.live/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 100 } }
  - id: abuse-ch
    name: abuse.ch
    domain: abuse.ch
    homepage: https://abuse.ch
    categories: [cyber]
    tier: A
    country: CH
    aliases: [urlhaus, threatfox, malwarebazaar, feodo tracker, sslbl]
    llm: false
    notes: "URLhaus/ThreatFox/MalwareBazaar APIs require an Auth-Key since 2025; only the Feodo Tracker JSON blocklist is anonymous."
    discover: { rss: false }
    sensors:
      - { name: feodo tracker c2 blocklist, url: "https://feodotracker.abuse.ch/downloads/ipblocklist.json", type: JSON, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: ip_address, titleTemplate: "{malware} C2 {ip_address}:{port} ({country}, {as_name})", dateField: first_seen, urlTemplate: "https://feodotracker.abuse.ch/browse/host/{key}/", compareFields: [status, last_online], maxItems: 500 } }

  # ───────────────────────── E · National CERTs, CSIRTs & cyber agencies ─────────────────────────
  - id: ncsc-uk
    name: NCSC (UK National Cyber Security Centre)
    domain: ncsc.gov.uk
    homepage: https://www.ncsc.gov.uk
    categories: [cyber, government]
    tier: A
    weight: 1.3
    country: GB
    aliases: [ncsc, uk ncsc, national cyber security centre]
    discover: { rss: false }
    sensors:
      - { name: all content feed, url: "https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml", type: RSS, connector: rss, tier: A }
      - { name: news feed, url: "https://www.ncsc.gov.uk/api/1/services/v1/news-rss-feed.xml", type: RSS, connector: rss, tier: B }
      - { name: reports & advisories feed, url: "https://www.ncsc.gov.uk/api/1/services/v1/report-rss-feed.xml", type: RSS, connector: rss, tier: A }
      - { name: gov.uk publications atom, url: "https://www.gov.uk/government/organisations/national-cyber-security-centre.atom", type: ATOM, connector: rss, tier: C }
  - id: cccs
    name: Canadian Centre for Cyber Security
    domain: cyber.gc.ca
    homepage: https://www.cyber.gc.ca
    categories: [cyber, government]
    tier: A
    weight: 1.2
    country: CA
    aliases: [cccs, cyber centre, centre canadien pour la cybersécurité, cse cyber centre]
    discover: { rss: false }
    sensors:
      - { name: alerts & advisories atom, url: "https://www.cyber.gc.ca/api/cccs/atom/v1/get?feed=alerts_advisories&lang=en", type: ATOM, connector: rss, tier: A, config: { maxItems: 50 } }
      - { name: alertes et avis (fr), url: "https://www.cyber.gc.ca/api/cccs/atom/v1/get?feed=alerts_advisories&lang=fr", type: ATOM, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: cert-fr
    name: CERT-FR (ANSSI)
    domain: cert.ssi.gouv.fr
    homepage: https://www.cert.ssi.gouv.fr
    categories: [cyber, government]
    tier: A
    weight: 1.2
    country: FR
    language: fr
    aliases: [cert-fr, anssi, agence nationale de la sécurité des systèmes d'information]
    discover: { rss: false }
    sensors:
      - { name: avis de sécurité, url: "https://www.cert.ssi.gouv.fr/avis/feed/", type: RSS, connector: rss, tier: A }
      - { name: alertes, url: "https://www.cert.ssi.gouv.fr/alerte/feed/", type: RSS, connector: rss, tier: S }
      - { name: menaces et incidents (cti), url: "https://www.cert.ssi.gouv.fr/cti/feed/", type: RSS, connector: rss, tier: B }
      - { name: indicateurs de compromission, url: "https://www.cert.ssi.gouv.fr/ioc/feed/", type: RSS, connector: rss, tier: B }
      - { name: actualités, url: "https://www.cert.ssi.gouv.fr/actualite/feed/", type: RSS, connector: rss, tier: C }
  - id: cert-bund
    name: CERT-Bund (BSI)
    domain: cert-bund.de
    homepage: https://wid.cert-bund.de/portal/wid/kurzinformationen
    categories: [cyber, government]
    tier: A
    weight: 1.2
    country: DE
    language: de
    aliases: [cert-bund, bsi, bundesamt für sicherheit in der informationstechnik, warn- und informationsdienst]
    notes: "bsi.bund.de RSS endpoints return 404; the WID portal's 'rss' endpoint returns a JSON envelope (items[])."
    discover: { rss: false }
    sensors:
      - { name: wid security advisories, url: "https://wid.cert-bund.de/content/public/securityAdvisory/rss", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: items, keyField: link, titleField: title, urlField: link, summaryField: description, dateField: pubDate, compareFields: [title], maxItems: 100 } }
  - id: cert-eu
    name: CERT-EU
    domain: cert.europa.eu
    homepage: https://cert.europa.eu
    categories: [cyber, government, international]
    tier: A
    country: EU
    aliases: [cert-eu, cybersecurity service for the union institutions]
    discover: { rss: false }
    sensors:
      - { name: security advisories feed, url: "https://cert.europa.eu/publications/security-advisories-rss", type: RSS, connector: rss, tier: A }
      - { name: threat intelligence feed, url: "https://cert.europa.eu/publications/threat-intelligence-rss", type: RSS, connector: rss, tier: B }
      - { name: security guidance feed, url: "https://cert.europa.eu/publications/security-guidance-rss", type: RSS, connector: rss, tier: C }
  - id: enisa
    extend: true
    country: EU
    products:
      - { name: EUVD, type: dataset, aliases: [european union vulnerability database, eu vulnerability database] }
    notes: "enisa.europa.eu RSS endpoints return 404; EUVD API (euvdservices) is public JSON."
    sensors:
      - { name: euvd latest vulnerabilities, url: "https://euvdservices.enisa.europa.eu/api/lastvulnerabilities", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — CVSS {baseScore} ({assigner})", summaryField: description, dateField: datePublished, urlTemplate: "https://euvd.enisa.europa.eu/vulnerability/{key}", compareFields: [baseScore, dateUpdated, exploitedSince], maxItems: 50 } }
      - { name: euvd exploited vulnerabilities, url: "https://euvdservices.enisa.europa.eu/api/exploitedvulnerabilities", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — exploited since {exploitedSince} (CVSS {baseScore})", summaryField: description, dateField: dateUpdated, urlTemplate: "https://euvd.enisa.europa.eu/vulnerability/{key}", compareFields: [baseScore, exploitedSince], maxItems: 50 } }
      - { name: euvd critical vulnerabilities, url: "https://euvdservices.enisa.europa.eu/api/criticalvulnerabilities", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — critical CVSS {baseScore}", summaryField: description, dateField: datePublished, urlTemplate: "https://euvd.enisa.europa.eu/vulnerability/{key}", compareFields: [baseScore, dateUpdated], maxItems: 50 } }
  - id: europol
    extend: true
    country: EU
  - id: jpcert
    name: JPCERT/CC
    domain: jpcert.or.jp
    homepage: https://www.jpcert.or.jp/english/
    categories: [cyber]
    tier: A
    country: JP
    aliases: [jpcert, japan computer emergency response team coordination center]
    discover: { rss: false }
    sensors:
      - { name: english feed, url: "https://www.jpcert.or.jp/english/rss/jpcert-en.rdf", type: RSS, connector: rss, tier: A }
  - id: jvn
    name: JVN (Japan Vulnerability Notes)
    domain: jvn.jp
    homepage: https://jvn.jp/en/
    categories: [cyber, government]
    tier: A
    country: JP
    aliases: [jvn, jvndb, japan vulnerability notes]
    llm: false
    discover: { rss: false }
    sensors:
      - { name: jvn notes feed, url: "https://jvn.jp/en/rss/jvn.rdf", type: RSS, connector: rss, tier: A }
      - { name: jvndb new entries feed, url: "https://jvndb.jvn.jp/en/rss/jvndb_new.rdf", type: RSS, connector: rss, tier: B, config: { maxItems: 100 } }
  - id: ipa-japan
    name: IPA (Information-technology Promotion Agency, Japan)
    domain: ipa.go.jp
    homepage: https://www.ipa.go.jp/security/
    categories: [cyber, government]
    tier: B
    country: JP
    language: ja
    aliases: [ipa, 情報処理推進機構]
    discover: { rss: false }
    sensors:
      - { name: security alerts feed, url: "https://www.ipa.go.jp/security/rss/alert.rdf", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: ncsc-nl
    name: NCSC-NL
    domain: ncsc.nl
    homepage: https://www.ncsc.nl
    categories: [cyber, government]
    tier: A
    country: NL
    aliases: [ncsc-nl, nationaal cyber security centrum]
    discover: { rss: false }
    sensors:
      - { name: security advisories feed, url: "https://advisories.ncsc.nl/rss/advisories", type: RSS, connector: rss, tier: A }
  - id: incibe
    name: INCIBE-CERT
    domain: incibe.es
    homepage: https://www.incibe.es/en/incibe-cert
    categories: [cyber, government]
    tier: A
    country: ES
    aliases: [incibe, incibe-cert, instituto nacional de ciberseguridad]
    discover: { rss: false }
    sensors:
      - { name: security advisories feed (en), url: "https://www.incibe.es/en/incibe-cert/early-warning/security-advisories/feed", type: RSS, connector: rss, tier: A }
      - { name: avisos sci (ics), url: "https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/feed", type: RSS, connector: rss, tier: B }
      - { name: blog feed, url: "https://www.incibe.es/incibe-cert/blog/feed", type: RSS, connector: rss, tier: C }
  - id: cert-pl
    name: CERT Polska
    domain: cert.pl
    homepage: https://cert.pl/en/
    categories: [cyber, government]
    tier: B
    country: PL
    aliases: [cert polska, cert.pl, nask]
    discover: { rss: false }
    sensors:
      - { name: english feed, url: "https://cert.pl/en/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: cert-at
    name: CERT.at
    domain: cert.at
    homepage: https://www.cert.at
    categories: [cyber, government]
    tier: A
    country: AT
    language: de
    aliases: [cert.at, govcert austria]
    discover: { rss: false }
    sensors:
      - { name: warnungen, url: "https://www.cert.at/cert-at.de.warnings.rss_2.0.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 50 } }
      - { name: alle meldungen, url: "https://www.cert.at/cert-at.de.all.rss_2.0.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }
  - id: ccb-belgium
    name: Centre for Cybersecurity Belgium
    domain: ccb.belgium.be
    homepage: https://ccb.belgium.be
    categories: [cyber, government]
    tier: A
    country: BE
    aliases: [ccb, cert.be, centre for cyber security belgium]
    discover: { rss: false }
    sensors:
      - { name: advisories feed, url: "https://ccb.belgium.be/advisories.xml", type: RSS, connector: rss, tier: A }
      - { name: news feed, url: "https://ccb.belgium.be/news.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }
  - id: cert-se
    name: CERT-SE
    domain: cert.se
    homepage: https://www.cert.se
    categories: [cyber, government]
    tier: B
    country: SE
    language: sv
    aliases: [cert-se, msb cert]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.cert.se/feed/rss.xml", type: RSS, connector: rss, tier: B }
  - id: si-cert
    name: SI-CERT
    domain: cert.si
    homepage: https://www.cert.si/en/
    categories: [cyber, government]
    tier: C
    country: SI
    aliases: [si-cert, slovenian computer emergency response team]
    discover: { rss: false }
    sensors:
      - { name: english feed, url: "https://www.cert.si/en/feed/", type: RSS, connector: rss, tier: C }
  - id: cert-hr
    name: CERT.hr (CARNET)
    domain: cert.hr
    homepage: https://www.cert.hr
    categories: [cyber, government]
    tier: C
    country: HR
    language: hr
    aliases: [cert.hr, nacionalni cert]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.cert.hr/feed/", type: RSS, connector: rss, tier: C }
  - id: csirt-sk
    name: CSIRT.SK
    domain: csirt.sk
    homepage: https://www.csirt.sk
    categories: [cyber, government]
    tier: C
    country: SK
    language: sk
    aliases: [csirt.sk, sk-cert]
    llm: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.csirt.sk/feed", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }
  - id: dnsc-romania
    name: DNSC (Romanian National Cyber Security Directorate)
    domain: dnsc.ro
    homepage: https://www.dnsc.ro
    categories: [cyber, government]
    tier: C
    country: RO
    language: ro
    aliases: [dnsc, cert-ro, directoratul național de securitate cibernetică]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.dnsc.ro/feed", type: RSS, connector: rss, tier: C }
  - id: cert-ua
    name: CERT-UA
    domain: cert.gov.ua
    homepage: https://cert.gov.ua
    categories: [cyber, government]
    tier: A
    country: UA
    language: uk
    aliases: [cert-ua, урядова команда реагування на комп'ютерні надзвичайні події україни]
    discover: { rss: false }
    sensors:
      - { name: articles feed, url: "https://cert.gov.ua/api/articles/rss", type: RSS, connector: rss, tier: A }
  - id: kisa-krcert
    name: KISA KrCERT/CC
    domain: boho.or.kr
    homepage: https://www.boho.or.kr
    categories: [cyber, government]
    tier: B
    country: KR
    language: ko
    aliases: [krcert, kisa, korea internet & security agency]
    discover: { rss: false }
    sensors:
      - { name: security notices feed, url: "https://www.boho.or.kr/kr/rss.do?bbsId=B0000133", type: RSS, connector: rss, tier: B }
  - id: cert-br
    name: CERT.br
    domain: cert.br
    homepage: https://www.cert.br
    categories: [cyber]
    tier: C
    country: BR
    language: pt
    aliases: [cert.br, nic.br cert]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://cert.br/rss/certbr-rss.xml", type: RSS, connector: rss, tier: C }
  - id: cert-ae
    name: UAE Cyber Security Council (aeCERT)
    domain: cert.ae
    homepage: https://www.cert.ae
    categories: [cyber, government]
    tier: C
    country: AE
    aliases: [aecert, uae cert]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.cert.ae/feed/", type: RSS, connector: rss, tier: C }
  - id: traficom-ncsc-fi
    name: NCSC-FI (Traficom)
    domain: kyberturvallisuuskeskus.fi
    homepage: https://www.kyberturvallisuuskeskus.fi/en/
    categories: [cyber, government]
    tier: B
    country: FI
    aliases: [ncsc-fi, kyberturvallisuuskeskus, finnish transport and communications agency cyber security centre]
    discover: { rss: false }
    sensors:
      - { name: english feed, url: "https://www.kyberturvallisuuskeskus.fi/feed/rss/en", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: cnil
    extend: true
    sensors:
      - { name: english feed, url: "https://www.cnil.fr/en/rss.xml", type: RSS, connector: rss, tier: C }

  # ───────────────────────── F · Threat-intelligence & security research vendors ─────────────────────────
  - id: kaspersky
    name: Kaspersky
    domain: kaspersky.com
    homepage: https://www.kaspersky.com
    categories: [cyber]
    tier: B
    country: RU
    aliases: [securelist, kaspersky lab, great]
    products:
      - { name: Securelist, type: service, aliases: [securelist blog] }
      - { name: Kaspersky ICS CERT, type: service, aliases: [ics cert kaspersky] }
    discover: { rss: false }
    sensors:
      - { name: securelist feed, url: "https://securelist.com/feed/", type: RSS, connector: rss, tier: B }
      - { name: securelist apt reports, url: "https://securelist.com/category/apt-reports/feed/", type: RSS, connector: rss, tier: B }
      - { name: ics cert feed, url: "https://ics-cert.kaspersky.com/feed/", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
      - { name: daily blog feed, url: "https://www.kaspersky.com/blog/feed/", type: RSS, connector: rss, tier: C }
  - id: eset
    name: ESET
    domain: eset.com
    homepage: https://www.eset.com
    categories: [cyber]
    tier: B
    country: SK
    aliases: [welivesecurity, eset research]
    products:
      - { name: WeLiveSecurity, type: service, aliases: [we live security] }
    discover: { rss: false }
    sensors:
      - { name: welivesecurity feed, url: "https://www.welivesecurity.com/en/rss/feed/", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: check-point
    name: Check Point Software
    domain: checkpoint.com
    homepage: https://www.checkpoint.com
    categories: [cyber]
    tier: B
    country: IL
    aliases: [check point research, cpr, checkpoint]
    products:
      - { name: Check Point Research, type: service, aliases: [cpr] }
    discover: { rss: false }
    sensors:
      - { name: research feed, url: "https://research.checkpoint.com/feed/", type: RSS, connector: rss, tier: B }
      - { name: blog feed, url: "https://blog.checkpoint.com/feed/", type: RSS, connector: rss, tier: C }
  - id: recorded-future
    name: Recorded Future
    domain: recordedfuture.com
    homepage: https://www.recordedfuture.com
    categories: [cyber]
    tier: B
    country: US
    aliases: [insikt group]
    discover: { rss: false }
    sensors:
      - { name: blog & research feed, url: "https://www.recordedfuture.com/feed", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: greynoise
    name: GreyNoise Intelligence
    domain: greynoise.io
    homepage: https://www.greynoise.io
    categories: [cyber]
    tier: B
    country: US
    aliases: [greynoise]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.greynoise.io/blog/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: huntress
    name: Huntress
    domain: huntress.com
    homepage: https://www.huntress.com
    categories: [cyber]
    tier: B
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.huntress.com/blog/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: datadog
    extend: true
    categories: [cyber]
    products:
      - { name: Datadog Security Labs, type: service, aliases: [security labs] }
    sensors:
      - { name: security labs feed, url: "https://securitylabs.datadoghq.com/rss/feed.xml", type: RSS, connector: rss, tier: B }
  - id: orca-security
    name: Orca Security
    domain: orca.security
    homepage: https://orca.security
    categories: [cyber, cloud]
    tier: C
    country: US
    aliases: [orca]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://orca.security/resources/blog/feed/", type: RSS, connector: rss, tier: C }
  - id: qualys
    name: Qualys
    domain: qualys.com
    homepage: https://www.qualys.com
    categories: [cyber, enterprise]
    tier: B
    country: US
    aliases: [qualys tru, threat research unit]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.qualys.com/feed", type: RSS, connector: rss, tier: B }
      - { name: threatprotect feed, url: "https://threatprotect.qualys.com/feed/", type: RSS, connector: rss, tier: A }
  - id: bitdefender
    name: Bitdefender
    domain: bitdefender.com
    homepage: https://www.bitdefender.com
    categories: [cyber, consumer-tech]
    tier: C
    country: RO
    aliases: [bitdefender labs, hot for security]
    discover: { rss: false }
    sensors:
      - { name: labs feed, url: "https://www.bitdefender.com/nuxt/api/en-us/rss/labs/", type: RSS, connector: rss, tier: C }
      - { name: hot for security feed, url: "https://www.bitdefender.com/nuxt/api/en-us/rss/hotforsecurity/", type: RSS, connector: rss, tier: C }
  - id: avast
    name: Avast (Gen Digital)
    domain: avast.com
    homepage: https://www.avast.com
    categories: [cyber, consumer-tech]
    tier: C
    country: CZ
    aliases: [gen digital, avast threat labs, norton lifelock]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.avast.com/rss.xml", type: RSS, connector: rss, tier: C }
  - id: cybereason
    name: Cybereason
    domain: cybereason.com
    homepage: https://www.cybereason.com
    categories: [cyber]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.cybereason.com/blog/rss.xml", type: RSS, connector: rss, tier: C }
  - id: arctic-wolf
    name: Arctic Wolf
    domain: arcticwolf.com
    homepage: https://arcticwolf.com
    categories: [cyber]
    tier: C
    country: US
    aliases: [arctic wolf labs]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://arcticwolf.com/feed/", type: RSS, connector: rss, tier: C }
  - id: forescout
    name: Forescout
    domain: forescout.com
    homepage: https://www.forescout.com
    categories: [cyber]
    tier: C
    country: US
    aliases: [vedere labs]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.forescout.com/feed/", type: RSS, connector: rss, tier: C }
  - id: censys
    name: Censys
    domain: censys.com
    homepage: https://censys.com
    categories: [cyber, internet]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://censys.com/feed/", type: RSS, connector: rss, tier: C }
  - id: shodan
    name: Shodan
    domain: shodan.io
    homepage: https://www.shodan.io
    categories: [cyber, internet]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.shodan.io/rss/", type: RSS, connector: rss, tier: C }
  - id: cloudsek
    name: CloudSEK
    domain: cloudsek.com
    homepage: https://www.cloudsek.com
    categories: [cyber]
    tier: C
    country: IN
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.cloudsek.com/blog/rss.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }
  - id: intel471
    name: Intel 471
    domain: intel471.com
    homepage: https://www.intel471.com
    categories: [cyber]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.intel471.com/blog/feed", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }
  - id: flashpoint
    name: Flashpoint
    domain: flashpoint.io
    homepage: https://flashpoint.io
    categories: [cyber]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://flashpoint.io/blog/feed/", type: RSS, connector: rss, tier: C }
  - id: socradar
    name: SOCRadar
    domain: socradar.io
    homepage: https://socradar.io
    categories: [cyber]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://socradar.io/feed/", type: RSS, connector: rss, tier: C }
  - id: eclecticiq
    name: EclecticIQ
    domain: eclecticiq.com
    homepage: https://www.eclecticiq.com
    categories: [cyber]
    tier: C
    country: NL
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.eclecticiq.com/rss.xml", type: RSS, connector: rss, tier: C }
  - id: sygnia
    name: Sygnia
    domain: sygnia.co
    homepage: https://www.sygnia.co
    categories: [cyber]
    tier: C
    country: IL
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.sygnia.co/feed/", type: RSS, connector: rss, tier: C }
  - id: resecurity
    name: Resecurity
    domain: resecurity.com
    homepage: https://www.resecurity.com
    categories: [cyber]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.resecurity.com/feed", type: RSS, connector: rss, tier: C }
  - id: ahnlab
    name: AhnLab
    domain: ahnlab.com
    homepage: https://asec.ahnlab.com/en/
    categories: [cyber]
    tier: C
    country: KR
    aliases: [asec, ahnlab security intelligence center]
    discover: { rss: false }
    sensors:
      - { name: asec english feed, url: "https://asec.ahnlab.com/en/feed/", type: RSS, connector: rss, tier: C }
  - id: any-run
    name: ANY.RUN
    domain: any.run
    homepage: https://any.run
    categories: [cyber]
    tier: C
    country: AE
    aliases: [anyrun sandbox]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://any.run/cybersecurity-blog/feed/", type: RSS, connector: rss, tier: C }
  - id: infoblox
    name: Infoblox
    domain: infoblox.com
    homepage: https://www.infoblox.com
    categories: [cyber, internet]
    tier: C
    country: US
    aliases: [infoblox threat intel]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.infoblox.com/blog/feed/", type: RSS, connector: rss, tier: C }
  - id: exodus-intelligence
    name: Exodus Intelligence
    domain: exodusintel.com
    homepage: https://www.exodusintel.com
    categories: [cyber]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.exodusintel.com/feed/", type: RSS, connector: rss, tier: C }
  - id: reversinglabs
    name: ReversingLabs
    domain: reversinglabs.com
    homepage: https://www.reversinglabs.com
    categories: [cyber, developer]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.reversinglabs.com/blog/rss.xml", type: RSS, connector: rss, tier: C }
  - id: endor-labs
    name: Endor Labs
    domain: endorlabs.com
    homepage: https://www.endorlabs.com
    categories: [cyber, developer]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: learn feed, url: "https://www.endorlabs.com/learn/rss.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }
  - id: legit-security
    name: Legit Security
    domain: legitsecurity.com
    homepage: https://www.legitsecurity.com
    categories: [cyber, developer]
    tier: D
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.legitsecurity.com/blog/rss.xml", type: RSS, connector: rss, tier: D }
  - id: cycode
    name: Cycode
    domain: cycode.com
    homepage: https://cycode.com
    categories: [cyber, developer]
    tier: D
    country: US
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://cycode.com/feed/", type: RSS, connector: rss, tier: D }
  - id: mend
    name: Mend.io
    domain: mend.io
    homepage: https://www.mend.io
    categories: [cyber, developer]
    tier: D
    country: IL
    aliases: [whitesource, renovate]
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.mend.io/blog/feed/", type: RSS, connector: rss, tier: D }
  - id: checkmarx
    name: Checkmarx
    domain: checkmarx.com
    homepage: https://checkmarx.com
    categories: [cyber, developer]
    tier: D
    country: US
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://checkmarx.com/feed/", type: RSS, connector: rss, tier: D }
  - id: trail-of-bits
    name: Trail of Bits
    domain: trailofbits.com
    homepage: https://www.trailofbits.com
    categories: [cyber, developer]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://blog.trailofbits.com/index.xml", type: RSS, connector: rss, tier: C }
  - id: bishop-fox
    name: Bishop Fox
    domain: bishopfox.com
    homepage: https://bishopfox.com
    categories: [cyber]
    tier: C
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://bishopfox.com/feeds/blog.rss", type: RSS, connector: rss, tier: C }
  - id: praetorian
    name: Praetorian
    domain: praetorian.com
    homepage: https://www.praetorian.com
    categories: [cyber]
    tier: D
    country: US
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.praetorian.com/blog/feed/", type: RSS, connector: rss, tier: D }
  - id: synacktiv
    name: Synacktiv
    domain: synacktiv.com
    homepage: https://www.synacktiv.com
    categories: [cyber]
    tier: C
    country: FR
    discover: { rss: false }
    sensors:
      - { name: english blog feed, url: "https://www.synacktiv.com/en/feed/lastblog.xml", type: RSS, connector: rss, tier: C }
  - id: assetnote
    name: Assetnote (Searchlight Cyber)
    domain: assetnote.io
    homepage: https://www.assetnote.io
    categories: [cyber]
    tier: C
    country: AU
    discover: { rss: false }
    sensors:
      - { name: research blog feed, url: "https://blog.assetnote.io/feed.xml", type: RSS, connector: rss, tier: C }
  - id: horizon3
    name: Horizon3.ai
    domain: horizon3.ai
    homepage: https://horizon3.ai
    categories: [cyber]
    tier: C
    country: US
    aliases: [horizon3 attack team, nodezero]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://horizon3.ai/feed/", type: RSS, connector: rss, tier: C }
  - id: watchtowr
    name: watchTowr
    domain: watchtowr.com
    homepage: https://watchtowr.com
    categories: [cyber]
    tier: B
    country: SG
    aliases: [watchtowr labs]
    discover: { rss: false }
    sensors:
      - { name: labs feed, url: "https://labs.watchtowr.com/rss/", type: RSS, connector: rss, tier: B }
  - id: intigriti
    name: Intigriti
    domain: intigriti.com
    homepage: https://www.intigriti.com
    categories: [cyber]
    tier: D
    country: BE
    discover: { rss: false }
    sensors:
      - { name: blog feed, url: "https://www.intigriti.com/blog/feed", type: ATOM, connector: rss, tier: D }
  - id: mdsec
    name: MDSec
    domain: mdsec.co.uk
    homepage: https://www.mdsec.co.uk
    categories: [cyber]
    tier: C
    country: GB
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.mdsec.co.uk/feed/", type: RSS, connector: rss, tier: C }
  - id: pentest-partners
    name: Pen Test Partners
    domain: pentestpartners.com
    homepage: https://www.pentestpartners.com
    categories: [cyber]
    tier: D
    country: GB
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.pentestpartners.com/feed/", type: RSS, connector: rss, tier: D }
  - id: portswigger
    name: PortSwigger
    domain: portswigger.net
    homepage: https://portswigger.net
    categories: [cyber, developer]
    tier: C
    country: GB
    aliases: [burp suite, portswigger research]
    discover: { rss: false }
    sensors:
      - { name: research feed, url: "https://portswigger.net/research/rss", type: RSS, connector: rss, tier: C }
  - id: cloudflare
    extend: true
    sensors:
      - { name: security tag feed, url: "https://blog.cloudflare.com/tag/security/rss/", type: RSS, connector: rss, tier: B }
      - { name: vulnerabilities tag feed, url: "https://blog.cloudflare.com/tag/vulnerabilities/rss/", type: RSS, connector: rss, tier: A }
      - { name: post-mortem tag feed, url: "https://blog.cloudflare.com/tag/post-mortem/rss/", type: RSS, connector: rss, tier: A }
  - id: proofpoint
    extend: true
    country: US
    sensors:
      - { name: threat insight blog feed, url: "https://www.proofpoint.com/us/threat-insight-blog.xml", type: RSS, connector: rss, tier: B }
  - id: zscaler
    extend: true
    products:
      - { name: ThreatLabz, type: service, aliases: [zscaler threatlabz] }
    sensors:
      - { name: security research blog feed, url: "https://www.zscaler.com/blogs/feeds/security-research", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: akamai
    extend: true
    notes: "akamai.com blog RSS paths return 403 (Akamai bot manager); the FeedBurner mirror is the only working feed."
  - id: sans-isc
    extend: true
    country: US
    sensors:
      - { name: diaries feed (short), url: "https://isc.sans.edu/rssfeed.xml", type: RSS, connector: rss, tier: A }
  - id: seclists
    name: SecLists.org (Full Disclosure / oss-security)
    domain: seclists.org
    homepage: https://seclists.org
    categories: [cyber, open-source]
    tier: B
    country: US
    aliases: [full disclosure, oss-security, seclists]
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: full disclosure list feed, url: "https://seclists.org/rss/fulldisclosure.rss", type: RSS, connector: rss, tier: B }
      - { name: oss-security list feed, url: "https://seclists.org/rss/oss-sec.rss", type: RSS, connector: rss, tier: A }

  # ───────────────────────── G · Security media & independent researchers (first_party: false) ─────────────────────────
  - id: bleepingcomputer
    extend: true
    country: US
    first_party: false
  - id: krebs-on-security
    extend: true
    country: US
    first_party: false
  - id: the-hacker-news
    extend: true
    country: IN
    first_party: false
  - id: the-record
    extend: true
    country: US
    first_party: false
  - id: securityweek
    name: SecurityWeek
    domain: securityweek.com
    homepage: https://www.securityweek.com
    categories: [news, media, cyber]
    tier: A
    weight: 0.8
    country: US
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.securityweek.com/feed/", type: RSS, connector: rss, tier: A }
  - id: dark-reading
    name: Dark Reading
    domain: darkreading.com
    homepage: https://www.darkreading.com
    categories: [news, media, cyber]
    tier: A
    weight: 0.8
    country: US
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.darkreading.com/rss.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 50 } }
  - id: cyberscoop
    name: CyberScoop
    domain: cyberscoop.com
    homepage: https://cyberscoop.com
    categories: [news, media, cyber, politics]
    tier: B
    weight: 0.8
    country: US
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://cyberscoop.com/feed/", type: RSS, connector: rss, tier: B }
  - id: risky-business
    name: Risky Business
    domain: risky.biz
    homepage: https://risky.biz
    categories: [news, media, cyber]
    tier: B
    weight: 0.7
    country: AU
    first_party: false
    llm: false
    aliases: [risky biz, risky business news]
    discover: { rss: false }
    sensors:
      - { name: podcast & newsletter feed, url: "https://risky.biz/rss.xml", type: RSS, connector: rss, tier: B }
      - { name: risky business news feed, url: "https://news.risky.biz/rss/", type: RSS, connector: rss, tier: B }
  - id: infosecurity-magazine
    name: Infosecurity Magazine
    domain: infosecurity-magazine.com
    homepage: https://www.infosecurity-magazine.com
    categories: [news, media, cyber]
    tier: B
    weight: 0.7
    country: GB
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: news feed, url: "https://www.infosecurity-magazine.com/rss/news/", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: help-net-security
    name: Help Net Security
    domain: helpnetsecurity.com
    homepage: https://www.helpnetsecurity.com
    categories: [news, media, cyber]
    tier: B
    weight: 0.6
    country: HR
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.helpnetsecurity.com/feed/", type: RSS, connector: rss, tier: B }
  - id: security-affairs
    name: Security Affairs
    domain: securityaffairs.com
    homepage: https://securityaffairs.com
    categories: [news, media, cyber]
    tier: B
    weight: 0.6
    country: IT
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://securityaffairs.com/feed", type: RSS, connector: rss, tier: B }
  - id: cso-online
    name: CSO Online
    domain: csoonline.com
    homepage: https://www.csoonline.com
    categories: [news, media, cyber]
    tier: B
    weight: 0.7
    country: US
    first_party: false
    llm: false
    aliases: [cso]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.csoonline.com/feed/", type: RSS, connector: rss, tier: B }
  - id: cybersecurity-dive
    name: Cybersecurity Dive
    domain: cybersecuritydive.com
    homepage: https://www.cybersecuritydive.com
    categories: [news, media, cyber]
    tier: B
    weight: 0.7
    country: US
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: news feed, url: "https://www.cybersecuritydive.com/feeds/news/", type: RSS, connector: rss, tier: B }
  - id: databreaches-net
    name: DataBreaches.net
    domain: databreaches.net
    homepage: https://databreaches.net
    categories: [news, media, cyber]
    tier: B
    weight: 0.6
    country: US
    first_party: false
    llm: false
    aliases: [databreaches, dissent doe]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://databreaches.net/feed/", type: RSS, connector: rss, tier: B }
  - id: schneier-on-security
    name: Schneier on Security
    domain: schneier.com
    homepage: https://www.schneier.com
    categories: [media, cyber]
    tier: C
    weight: 0.7
    country: US
    first_party: false
    aliases: [bruce schneier]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.schneier.com/feed/atom/", type: ATOM, connector: rss, tier: C }
  - id: troy-hunt
    name: Troy Hunt
    domain: troyhunt.com
    homepage: https://www.troyhunt.com
    categories: [media, cyber]
    tier: C
    weight: 0.6
    country: AU
    first_party: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.troyhunt.com/rss/", type: RSS, connector: rss, tier: C }
  - id: graham-cluley
    name: Graham Cluley
    domain: grahamcluley.com
    homepage: https://grahamcluley.com
    categories: [media, cyber]
    tier: C
    weight: 0.5
    country: GB
    first_party: false
    aliases: [smashing security]
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://grahamcluley.com/feed/", type: RSS, connector: rss, tier: C }
  - id: heise-security
    name: heise Security
    domain: heise.de
    homepage: https://www.heise.de/security/
    categories: [news, media, cyber]
    tier: B
    weight: 0.7
    country: DE
    language: de
    first_party: false
    llm: false
    aliases: [heise online security, heise]
    discover: { rss: false }
    sensors:
      - { name: security news feed, url: "https://www.heise.de/security/feed.xml", type: ATOM, connector: rss, tier: B }
      - { name: security alerts feed, url: "https://www.heise.de/security/Alerts/feed.xml", type: ATOM, connector: rss, tier: A }
  - id: golem-security
    name: Golem.de Security
    domain: golem.de
    homepage: https://www.golem.de/specials/security/
    categories: [news, media, cyber]
    tier: C
    weight: 0.5
    country: DE
    language: de
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: security feed, url: "https://rss.golem.de/rss.php?feed=RSS2.0&ms=security", type: RSS, connector: rss, tier: C }
  - id: zataz
    name: ZATAZ
    domain: zataz.com
    homepage: https://www.zataz.com
    categories: [news, media, cyber]
    tier: C
    weight: 0.5
    country: FR
    language: fr
    first_party: false
    llm: false
    discover: { rss: false }
    sensors:
      - { name: feed, url: "https://www.zataz.com/feed/", type: RSS, connector: rss, tier: C }
  - id: the-register
    extend: true
    sensors:
      - { name: security headlines, url: "https://www.theregister.com/security/headlines.atom", type: ATOM, connector: rss, tier: B, config: { maxItems: 50 } }
  - id: ars-technica
    extend: true
    sensors:
      - { name: security feed, url: "https://arstechnica.com/security/feed/", type: RSS, connector: rss, tier: B }
  - id: wired
    extend: true
    sensors:
      - { name: security feed, url: "https://www.wired.com/feed/category/security/latest/rss", type: RSS, connector: rss, tier: B }