SPB Git forge

spb/websensor

Public
33commits 1branches 0releases
3.4 MBsize
maindefault branch
10 days agolast push
TypeScript 55.4% Python 43.2% SQL 1.2%
79.7 KB · 1,771 lines yaml
Raw Blame History
1# config/sources.d/42-cybersecurity.yaml — cybersecurity coverage (2026-09-11): CVE/KEV/EPSS feeds, vendor PSIRT2# advisories, national CERTs, exploit & ransomware trackers, threat-intel research blogs, supply-chain / dependency3# vulnerability databases, security tooling releases and security media. Extends the founding cyber block (cisa, nvd,4# nist, cert-cc, mitre, microsoft-security, …) and earlier fragments; every URL below was fetched and parsed on5# 2026-09-11. Blocked / JS-only pages (Oracle CPU, Adobe PSIRT, Broadcom/VMware advisories, Citrix bulletins, SonicWall6# PSIRT, Juniper, F5 MyF5, Akamai blog RSS, Trellix, BSI RSS, ENISA news RSS, ACSC, Shadowserver, Packet Storm TOS wall,7# CVE.org list API, OSV POST API, VulnCheck auth) are recorded in `notes:` instead of pretending.8sources:9  # ───────────────────────── A · US government, CVE ecosystem, scoring ─────────────────────────10  - id: cisa11    extend: true12    country: US13    aliases: [us-cert, ics-cert, cisa kev]14    products:15      - { name: ICS Advisories, type: service, aliases: [ics-cert advisories, icsa] }16      - { name: Vulnrichment, type: dataset, aliases: [cisa vulnrichment, ssvc] }17    sensors:18      - { name: ics advisories feed, url: "https://www.cisa.gov/cybersecurity-advisories/ics-advisories.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 60 } }19      - { name: ics medical advisories feed, url: "https://www.cisa.gov/cybersecurity-advisories/ics-medical-advisories.xml", type: RSS, connector: rss, tier: B }20      - { name: alerts feed, url: "https://www.cisa.gov/cybersecurity-advisories/alerts.xml", type: RSS, connector: rss, tier: S }21      - { name: cybersecurity advisories feed, url: "https://www.cisa.gov/cybersecurity-advisories/cybersecurity-advisories.xml", type: RSS, connector: rss, tier: A }22      - { name: analysis reports feed, url: "https://www.cisa.gov/cybersecurity-advisories/analysis-reports.xml", type: RSS, connector: rss, tier: B }23      - { name: blog feed, url: "https://www.cisa.gov/blog.xml", type: RSS, connector: rss, tier: C }24      - { name: vulnrichment commits, url: "https://github.com/cisagov/vulnrichment/commits/develop.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: cisagov/vulnrichment, kind: commits, branch: develop } }25      - { name: scubagear releases, url: "https://github.com/cisagov/ScubaGear/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: cisagov/ScubaGear, kind: releases } }26  - id: nvd27    extend: true28    country: US29    llm: false30    sensors:31      - name: newly published cves32        url: "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate={now-2h}&pubEndDate={now}&resultsPerPage=200"33        type: REST_API34        connector: jsonlist35        tier: A36        interval: 90037        config: { itemsPath: vulnerabilities, keyField: cve.id, titleTemplate: "{cve.id} — {cve.vulnStatus} ({cve.sourceIdentifier})", summaryField: cve.descriptions, dateField: cve.published, urlTemplate: "https://nvd.nist.gov/vuln/detail/{key}", compareFields: [cve.vulnStatus, cve.metrics], noConditional: true, maxItems: 200 }38  - id: nist39    extend: true40    country: US41    sensors:42      - { name: cybersecurity insights blog, url: "https://www.nist.gov/blogs/cybersecurity-insights/rss.xml", type: RSS, connector: rss, tier: C }43  - id: cert-cc44    extend: true45    country: US46    sensors:47      - { name: vulnerability notes atom, url: "https://www.kb.cert.org/vuls/atomfeed/", type: ATOM, connector: rss, tier: A }48  - id: mitre49    extend: true50    country: US51    products:52      - { name: CVE Program, type: service, aliases: [cve.org, cve list, cna] }53      - { name: ATT&CK, type: dataset, aliases: [mitre att&ck, attack framework] }54      - { name: CWE, type: dataset, aliases: [common weakness enumeration] }55    notes: "CVE.org list API (cveawg.mitre.org/api/cve-id) requires CNA credentials → not a sensor; mitre.org RSS returns 403 (Akamai)."56    sensors:57      - { name: cve program blog, url: "https://medium.com/feed/@cve_program", type: RSS, connector: rss, tier: C }58      - { name: attack blog, url: "https://medium.com/feed/mitre-attack", type: RSS, connector: rss, tier: C }59      - { name: cti stix releases, url: "https://github.com/mitre/cti/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: mitre/cti, kind: releases } }60      - { name: cve schema releases, url: "https://github.com/CVEProject/cve-schema/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: CVEProject/cve-schema, kind: releases } }61      - { name: attack navigator releases, url: "https://github.com/mitre-attack/attack-navigator/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: mitre-attack/attack-navigator, kind: releases } }62      - { name: attack flow releases, url: "https://github.com/center-for-threat-informed-defense/attack-flow/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: center-for-threat-informed-defense/attack-flow, kind: releases } }63  - id: first-org64    extend: true65    country: US66    products:67      - { name: EPSS, type: dataset, aliases: [exploit prediction scoring system, epss score] }68    sensors:69      - { name: epss scores updated today, url: "https://api.first.org/data/v1/epss?days=1&limit=100", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: data, keyField: cve, titleTemplate: "{cve} — EPSS {epss} (percentile {percentile})", dateField: date, urlTemplate: "https://nvd.nist.gov/vuln/detail/{key}", compareFields: [epss, percentile], maxItems: 100 } }70      - { name: epss top scores, url: "https://api.first.org/data/v1/epss?epss-gt=0.9&order=!date&limit=100", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: data, keyField: cve, titleTemplate: "{cve} — EPSS {epss}", dateField: date, urlTemplate: "https://nvd.nist.gov/vuln/detail/{key}", compareFields: [epss], maxItems: 100 } }71      - { name: press releases, url: "https://www.first.org/newsroom/releases/rss.xml", type: RSS, connector: rss, tier: C }72  - id: ic373    name: FBI Internet Crime Complaint Center74    domain: ic3.gov75    homepage: https://www.ic3.gov76    categories: [cyber, government]77    tier: A78    country: US79    aliases: [ic3, fbi ic3, internet crime complaint center]80    discover: { rss: false }81    sensors:82      - { name: public service announcements, url: "https://www.ic3.gov/PSA/RSS", type: RSS, connector: rss, tier: A }83      - { name: cybersecurity advisories, url: "https://www.ic3.gov/CSA/RSS", type: RSS, connector: rss, tier: A }84  - id: circl85    name: CIRCL (Computer Incident Response Center Luxembourg)86    domain: circl.lu87    homepage: https://www.circl.lu88    categories: [cyber, government]89    tier: B90    country: LU91    aliases: [circl, vulnerability-lookup, cve-search]92    products:93      - { name: Vulnerability-Lookup, type: service, aliases: [vulnerability.circl.lu] }94      - { name: MISP, type: software, aliases: [misp project, malware information sharing platform] }95    discover: { rss: false }96    sensors:97      - { name: news feed, url: "https://www.circl.lu/rss.xml", type: RSS, connector: rss, tier: C }98      - { name: latest vulnerabilities (vulnerability-lookup), url: "https://cve.circl.lu/api/last/30", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: "", keyField: id, titleTemplate: "{id}", summaryField: details, dateField: published, urlTemplate: "https://vulnerability.circl.lu/vuln/{key}", compareFields: [modified], maxItems: 30 } }99      - { name: misp releases, url: "https://github.com/MISP/MISP/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: MISP/MISP, kind: releases } }100101  # ───────────────────────── B · Platform vendors: advisories & security blogs ─────────────────────────102  - id: microsoft-security103    extend: true104    country: US105    products:106      - { name: Security Update Guide, type: service, aliases: [msrc update guide, patch tuesday, msrc cvrf] }107      - { name: Microsoft Threat Intelligence, type: service, aliases: [mstic, microsoft threat intelligence center] }108    sensors:109      - { name: security update guide feed, url: "https://api.msrc.microsoft.com/update-guide/rss", type: RSS, connector: rss, tier: S, config: { maxItems: 200 } }110      - { name: security blog feed, url: "https://www.microsoft.com/en-us/security/blog/feed/", type: RSS, connector: rss, tier: B }111      - { name: threat intelligence blog feed, url: "https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/feed/", type: RSS, connector: rss, tier: A }112  - id: apple-security113    extend: true114    country: US115    sensors:116      - { name: security research blog, url: "https://security.apple.com/blog/", type: HTML, connector: http, tier: C }117  - id: android118    name: Android Security119    domain: source.android.com120    homepage: https://source.android.com/docs/security121    categories: [cyber, consumer-tech]122    tier: A123    country: US124    aliases: [android security bulletin, android open source project security, aosp security]125    discover: { rss: false }126    sensors:127      - { name: security bulletins index, url: "https://source.android.com/docs/security/bulletin", type: HTML, connector: http, tier: A }128  - id: chromium129    extend: true130    country: US131    sensors:132      - { name: chrome stable channel updates, url: "https://chromereleases.googleblog.com/feeds/posts/default/-/Stable%20updates", type: ATOM, connector: rss, tier: A }133  - id: google134    extend: true135    sensors:136      - { name: safety & security blog, url: "https://blog.google/technology/safety-security/rss/", type: RSS, connector: rss, tier: B }137  - id: google-cloud138    extend: true139    products:140      - { name: Google Cloud Security Bulletins, type: service, aliases: [gcp security bulletins, gke security bulletins] }141    sensors:142      - { name: security bulletins feed, url: "https://cloud.google.com/feeds/google-cloud-security-bulletins.xml", type: ATOM, connector: rss, tier: A }143      - { name: gke security bulletins feed, url: "https://cloud.google.com/feeds/gke-security-bulletins.xml", type: ATOM, connector: rss, tier: A }144      - { name: identity & security blog, url: "https://cloudblog.withgoogle.com/products/identity-security/rss/", type: RSS, connector: rss, tier: C }145  - id: aws146    extend: true147    sensors:148      - { name: security blog feed, url: "https://aws.amazon.com/blogs/security/feed/", type: RSS, connector: rss, tier: B }149  - id: cisco-security150    extend: true151    country: US152    products:153      - { name: Cisco Talos, type: service, aliases: [talos, talos intelligence] }154    sensors:155      - { name: event responses feed, url: "https://sec.cloudapps.cisco.com/security/center/eventResponses_20.xml", type: RSS, connector: rss, tier: A }156      - { name: talos blog feed, url: "https://blog.talosintelligence.com/rss/", type: RSS, connector: rss, tier: B }157      - { name: cisco security blog feed, url: "https://blogs.cisco.com/security/feed", type: RSS, connector: rss, tier: C }158  - id: palo-alto-networks159    extend: true160    country: US161    sensors:162      - { name: corporate blog feed, url: "https://www.paloaltonetworks.com/blog/feed/", type: RSS, connector: rss, tier: C }163  - id: fortinet164    extend: true165    country: US166    products:167      - { name: FortiGuard Outbreak Alerts, type: service, aliases: [outbreak alerts] }168    notes: "fortinet.com blog RSS paths return 404; feeds.fortinet.com does not resolve."169    sensors:170      - { name: outbreak alerts feed, url: "https://filestore.fortinet.com/fortiguard/rss/outbreakalert.xml", type: RSS, connector: rss, tier: A }171  - id: sentinelone172    extend: true173    country: US174    products:175      - { name: SentinelLabs, type: service, aliases: [sentinel labs] }176    sensors:177      - { name: sentinellabs feed, url: "https://www.sentinelone.com/labs/feed/", type: RSS, connector: rss, tier: B }178  - id: sophos179    extend: true180    country: GB181    products:182      - { name: Sophos X-Ops, type: service, aliases: [x-ops, sophoslabs] }183    sensors:184      - { name: threat research feed, url: "https://www.sophos.com/en-us/category/threat-research/feed", type: RSS, connector: rss, tier: B }185  - id: trend-micro186    extend: true187    country: JP188    notes: "trendmicro.com research RSS paths return 404; FeedBurner security-news feed still served."189    sensors:190      - { name: security news feed, url: "https://feeds.feedburner.com/TrendMicroSecurityNews", type: RSS, connector: rss, tier: B }191  - id: zero-day-initiative192    name: Zero Day Initiative193    domain: zerodayinitiative.com194    homepage: https://www.zerodayinitiative.com195    categories: [cyber]196    tier: A197    country: US198    aliases: [zdi, trend micro zdi, pwn2own]199    llm: false200    discover: { rss: false }201    sensors:202      - { name: published advisories feed, url: "https://www.zerodayinitiative.com/rss/published/", type: RSS, connector: rss, tier: A, config: { maxItems: 100 } }203      - { name: upcoming advisories feed, url: "https://www.zerodayinitiative.com/rss/upcoming/", type: RSS, connector: rss, tier: B, config: { maxItems: 100 } }204      - { name: blog feed, url: "https://www.zerodayinitiative.com/blog?format=rss", type: RSS, connector: rss, tier: C }205  - id: tenable206    extend: true207    country: US208    sensors:209      - { name: cyber exposure alerts feed, url: "https://www.tenable.com/blog/cyber-exposure-alerts/feed", type: RSS, connector: rss, tier: A }210      - { name: product security advisories feed, url: "https://www.tenable.com/security/feed", type: RSS, connector: rss, tier: B }211  - id: rapid7212    extend: true213    country: US214    sensors:215      - { name: emergent threat response feed, url: "https://www.rapid7.com/blog/tag/emergent-threat-response/rss/", type: RSS, connector: rss, tier: A }216  - id: crowdstrike217    extend: true218    country: US219  - id: mandiant220    extend: true221    country: US222  - id: malwarebytes223    extend: true224    country: US225  - id: ivanti226    extend: true227    country: US228    sensors:229      - { name: security advisory blog feed, url: "https://www.ivanti.com/blog/topics/security-advisory/rss", type: RSS, connector: rss, tier: A }230  - id: broadcom231    extend: true232    categories: [cyber]233    notes: "VMware security advisories moved to support.broadcom.com (JS-rendered) → no advisories sensor; VMware security blog RSS kept."234    sensors:235      - { name: vmware security blog feed, url: "https://blogs.vmware.com/security/feed", type: RSS, connector: rss, tier: B }236  - id: atlassian237    extend: true238    categories: [cyber]239    sensors:240      - { name: security advisories space feed, url: "https://confluence.atlassian.com/createrssfeed.action?types=page&spaces=SECURITY&title=Security+Advisories&labelString=&excludedSpaceKeys=&sort=modified&maxResults=25&timeSpan=600&showContent=true&confirm=Create+RSS+Feed", type: ATOM, connector: rss, tier: A }241  - id: yubico242    name: Yubico243    domain: yubico.com244    homepage: https://www.yubico.com245    categories: [cyber, consumer-tech]246    tier: B247    country: SE248    aliases: [yubikey]249    discover: { rss: true }250    sensors:251      - { name: blog feed, url: "https://www.yubico.com/feed/", type: RSS, connector: rss, tier: C }252  - id: jamf253    name: Jamf254    domain: jamf.com255    homepage: https://www.jamf.com256    categories: [cyber, enterprise]257    tier: C258    country: US259    aliases: [jamf threat labs]260    discover: { rss: false }261    sensors:262      - { name: blog feed, url: "https://www.jamf.com/blog/rss/", type: RSS, connector: rss, tier: C }263  - id: hashicorp264    extend: true265    sensors:266      - { name: security announcements forum, url: "https://discuss.hashicorp.com/c/security/52.rss", type: RSS, connector: rss, tier: A }267  - id: mongodb268    extend: true269    categories: [cyber]270    sensors:271      - { name: server security issues (jira), url: "https://jira.mongodb.org/sr/jira.issueviews:searchrequest-rss/temp/SearchRequest.xml?jqlQuery=project+%3D+SERVER+AND+labels+%3D+security&tempMax=50", type: RSS, connector: rss, tier: B }272  - id: postgresql273    extend: true274    categories: [cyber]275    sensors:276      - { name: security information page, url: "https://www.postgresql.org/support/security/", type: HTML, connector: http, tier: B }277278  # ───────────────────────── C · Source code platforms, Linux, language ecosystems (dependency vulnerabilities) ─────────────────────────279  - id: github280    extend: true281    categories: [cyber]282    products:283      - { name: GitHub Advisory Database, type: dataset, aliases: [ghsa, github advisories, advisory database] }284      - { name: GitHub Security Lab, type: service, aliases: [security lab] }285    sensors:286      - { name: advisory database (all ecosystems), url: "https://api.github.com/advisories?per_page=100&sort=published", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, summaryField: description, dateField: published_at, compareFields: [severity, updated_at, withdrawn_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }287      - { name: advisories npm, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=npm", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }288      - { name: advisories pypi, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=pip", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }289      - { name: advisories maven, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=maven", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }290      - { name: advisories go, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=go", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }291      - { name: advisories rubygems, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=rubygems", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }292      - { name: advisories rust crates, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=rust", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }293      - { name: advisories composer, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=composer", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }294      - { name: advisories nuget, url: "https://api.github.com/advisories?per_page=100&sort=published&ecosystem=nuget", type: REST_API, connector: jsonlist, tier: C, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — {severity}: {summary}", urlField: html_url, dateField: published_at, compareFields: [severity, updated_at], maxItems: 100, headers: { accept: application/vnd.github+json } } }295      - { name: critical advisories, url: "https://api.github.com/advisories?per_page=50&sort=published&severity=critical", type: REST_API, connector: jsonlist, tier: B, config: { itemsPath: "", keyField: ghsa_id, titleTemplate: "{ghsa_id} {cve_id} — CRITICAL: {summary}", urlField: html_url, summaryField: description, dateField: published_at, compareFields: [updated_at, withdrawn_at], maxItems: 50, headers: { accept: application/vnd.github+json } } }296      - { name: security lab advisories feed, url: "https://securitylab.github.com/advisories/feed.xml", type: RSS, connector: rss, tier: B }297      - { name: vulnerability research blog feed, url: "https://github.blog/security/vulnerability-research/feed/", type: RSS, connector: rss, tier: C }298      - { name: advisory database commits, url: "https://github.com/github/advisory-database/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: github/advisory-database, kind: commits, branch: main } }299  - id: gitlab300    extend: true301    categories: [cyber]302    sensors:303      - { name: patch & security releases feed, url: "https://docs.gitlab.com/releases/patch-releases.xml", type: ATOM, connector: rss, tier: A, config: { maxItems: 50 } }304  - id: kubernetes305    extend: true306    categories: [cyber]307    products:308      - { name: Kubernetes Official CVE Feed, type: dataset, aliases: [k8s cve feed] }309    sensors:310      - { name: official cve feed, url: "https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json", type: JSON, connector: jsonlist, tier: A, config: { itemsPath: items, keyField: id, titleField: summary, urlField: url, summaryField: content_text, dateField: date_published, compareFields: [status, summary], maxItems: 200 } }311  - id: docker312    extend: true313    categories: [cyber]314    sensors:315      - { name: security blog category feed, url: "https://www.docker.com/blog/category/security/feed/", type: RSS, connector: rss, tier: C }316  - id: red-hat317    extend: true318    categories: [cyber]319    products:320      - { name: Red Hat Product Security, type: service, aliases: [rhsa, red hat security advisories, red hat security data api] }321    notes: "securitydata/cve.json returns a JSON-encoded string (double-encoded) → not parseable by jsonlist; csaf.json is a proper array."322    sensors:323      - { name: security advisories (csaf api), url: "https://access.redhat.com/hydra/rest/securitydata/csaf.json?per_page=100", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: RHSA, titleTemplate: "{RHSA} — {severity}: {CVEs}", urlField: resource_url, dateField: released_on, compareFields: [severity, released_on], maxItems: 100 } }324      - { name: security blog channel feed, url: "https://www.redhat.com/en/rss/blog/channel/security", type: RSS, connector: rss, tier: C }325  - id: suse326    extend: true327    categories: [cyber]328    sensors:329      - { name: security blog tag feed, url: "https://www.suse.com/c/tag/security/feed/", type: RSS, connector: rss, tier: C }330  - id: gentoo331    name: Gentoo Linux332    domain: gentoo.org333    homepage: https://www.gentoo.org334    categories: [open-source, cyber, developer]335    tier: B336    country: US337    aliases: [gentoo, glsa, gentoo linux security advisories]338    discover: { rss: false }339    sensors:340      - { name: glsa feed, url: "https://security.gentoo.org/glsa/feed.rss", type: RSS, connector: rss, tier: A }341  - id: linux-kernel342    extend: true343    categories: [cyber]344    products:345      - { name: Linux kernel CVE team, type: service, aliases: [linux-cve-announce, kernel cve] }346    sensors:347      - { name: linux-cve-announce feed, url: "https://lore.kernel.org/linux-cve-announce/new.atom", type: ATOM, connector: rss, tier: A, config: { maxItems: 100 } }348  - id: openssl349    extend: true350    sensors:351      - { name: vulnerabilities page, url: "https://openssl-library.org/news/vulnerabilities/", type: HTML, connector: http, tier: A }352  - id: python353    extend: true354    categories: [cyber]355    sensors:356      - { name: psf advisory database commits, url: "https://github.com/psf/advisory-database/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: psf/advisory-database, kind: commits, branch: main } }357      - { name: pypa advisory database commits, url: "https://github.com/pypa/advisory-database/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: pypa/advisory-database, kind: commits, branch: main } }358  - id: go359    extend: true360    categories: [cyber]361    products:362      - { name: Go Vulnerability Database, type: dataset, aliases: [govulndb, vuln.go.dev, govulncheck] }363    sensors:364      - { name: vulnerability database index, url: "https://vuln.go.dev/index/vulns.json", type: JSON, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — {aliases}", dateField: modified, urlTemplate: "https://pkg.go.dev/vuln/{key}", compareFields: [modified], maxItems: 10000 } }365  - id: rust366    extend: true367    categories: [cyber]368    products:369      - { name: RustSec Advisory Database, type: dataset, aliases: [rustsec, cargo-audit] }370    sensors:371      - { name: rustsec advisories feed, url: "https://rustsec.org/feed.xml", type: ATOM, connector: rss, tier: A }372      - { name: rustsec advisory-db commits, url: "https://github.com/rustsec/advisory-db/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: rustsec/advisory-db, kind: commits, branch: main } }373  - id: ruby374    extend: true375    categories: [cyber]376    sensors:377      - { name: ruby advisory database commits, url: "https://github.com/rubysec/ruby-advisory-db/commits/master.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: rubysec/ruby-advisory-db, kind: commits, branch: master } }378  - id: php379    extend: true380    categories: [cyber]381    sensors:382      - { name: friendsofphp security advisories commits, url: "https://github.com/FriendsOfPHP/security-advisories/commits/master.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: FriendsOfPHP/security-advisories, kind: commits, branch: master } }383  - id: nodejs384    extend: true385    categories: [cyber]386    sensors:387      - { name: security working group commits, url: "https://github.com/nodejs/security-wg/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: nodejs/security-wg, kind: commits, branch: main } }388  - id: wordpress389    extend: true390    categories: [cyber]391    sensors:392      - { name: security news feed, url: "https://wordpress.org/news/category/security/feed/", type: RSS, connector: rss, tier: A }393  - id: wordfence394    name: Wordfence395    domain: wordfence.com396    homepage: https://www.wordfence.com397    categories: [cyber, internet]398    tier: B399    country: US400    aliases: [defiant, wordfence threat intelligence]401    discover: { rss: false }402    sensors:403      - { name: blog feed, url: "https://www.wordfence.com/blog/feed/", type: RSS, connector: rss, tier: B }404  - id: patchstack405    name: Patchstack406    domain: patchstack.com407    homepage: https://patchstack.com408    categories: [cyber, internet]409    tier: B410    country: EE411    discover: { rss: false }412    sensors:413      - { name: articles feed, url: "https://patchstack.com/feed/", type: RSS, connector: rss, tier: B }414  - id: wpscan415    name: WPScan416    domain: wpscan.com417    homepage: https://wpscan.com418    categories: [cyber, internet]419    tier: C420    country: GB421    aliases: [wpscan vulnerability database]422    discover: { rss: false }423    sensors:424      - { name: blog feed, url: "https://wpscan.com/blog/feed/", type: RSS, connector: rss, tier: C }425  - id: sucuri426    name: Sucuri427    domain: sucuri.net428    homepage: https://sucuri.net429    categories: [cyber, internet]430    tier: C431    country: US432    aliases: [sucuri labs]433    discover: { rss: false }434    sensors:435      - { name: blog feed, url: "https://blog.sucuri.net/feed", type: RSS, connector: rss, tier: C }436437  # ───────────────────────── D · Supply-chain security, SBOM/VEX standards, security tooling ─────────────────────────438  - id: openssf439    extend: true440    products:441      - { name: OpenSSF Scorecard, type: software, aliases: [scorecard] }442      - { name: OSV Schema, type: standard, aliases: [osv schema, open source vulnerability schema] }443    sensors:444      - { name: scorecard releases, url: "https://github.com/ossf/scorecard/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: ossf/scorecard, kind: releases } }445      - { name: osv schema releases, url: "https://github.com/ossf/osv-schema/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: ossf/osv-schema, kind: releases } }446  - id: osv447    name: OSV.dev448    domain: osv.dev449    homepage: https://osv.dev450    categories: [cyber, open-source, developer]451    tier: B452    country: US453    aliases: [open source vulnerabilities, osv scanner, google osv]454    notes: "The OSV query API is POST-only → no jsonlist sensor; release feed of the scanner used instead."455    discover: { rss: false }456    sensors:457      - { name: osv-scanner releases, url: "https://github.com/google/osv-scanner/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: google/osv-scanner, kind: releases } }458  - id: sigstore459    name: Sigstore460    domain: sigstore.dev461    homepage: https://www.sigstore.dev462    categories: [cyber, open-source, developer]463    tier: C464    country: US465    aliases: [cosign, fulcio, rekor]466    discover: { rss: false }467    sensors:468      - { name: cosign releases, url: "https://github.com/sigstore/cosign/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: sigstore/cosign, kind: releases } }469  - id: chainguard470    name: Chainguard471    domain: chainguard.dev472    homepage: https://www.chainguard.dev473    categories: [cyber, developer, cloud]474    tier: C475    country: US476    aliases: [wolfi, chainguard images]477    discover: { rss: false }478    sensors:479      - { name: unchained blog feed, url: "https://www.chainguard.dev/unchained/rss.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }480      - { name: wolfi os commits, url: "https://github.com/wolfi-dev/os/commits/main.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: wolfi-dev/os, kind: commits, branch: main } }481      - { name: melange releases, url: "https://github.com/chainguard-dev/melange/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: chainguard-dev/melange, kind: releases } }482  - id: aqua-security483    name: Aqua Security484    domain: aquasec.com485    homepage: https://www.aquasec.com486    categories: [cyber, cloud, developer]487    tier: C488    country: IL489    aliases: [aqua nautilus, trivy]490    products:491      - { name: Trivy, type: software, aliases: [trivy scanner] }492    discover: { rss: false }493    sensors:494      - { name: blog feed, url: "https://blog.aquasec.com/rss.xml", type: RSS, connector: rss, tier: C }495      - { name: trivy releases, url: "https://github.com/aquasecurity/trivy/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: aquasecurity/trivy, kind: releases } }496  - id: anchore497    name: Anchore498    domain: anchore.com499    homepage: https://anchore.com500    categories: [cyber, developer]501    tier: D502    country: US503    aliases: [grype, syft]504    discover: { rss: true }505    sensors:506      - { name: grype releases, url: "https://github.com/anchore/grype/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: anchore/grype, kind: releases } }507      - { name: syft releases, url: "https://github.com/anchore/syft/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: anchore/syft, kind: releases } }508  - id: cyclonedx509    name: OWASP CycloneDX510    domain: cyclonedx.org511    homepage: https://cyclonedx.org512    categories: [cyber, standards, open-source]513    tier: D514    country: US515    aliases: [cyclonedx, sbom standard]516    discover: { rss: false }517    sensors:518      - { name: specification releases, url: "https://github.com/CycloneDX/specification/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: CycloneDX/specification, kind: releases } }519  - id: spdx520    name: SPDX521    domain: spdx.dev522    homepage: https://spdx.dev523    categories: [cyber, standards, open-source]524    tier: D525    country: US526    aliases: [software package data exchange]527    discover: { rss: false }528    sensors:529      - { name: specification releases, url: "https://github.com/spdx/spdx-spec/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: spdx/spdx-spec, kind: releases } }530  - id: oasis-csaf531    name: OASIS CSAF532    domain: oasis-open.org533    homepage: https://oasis-open.github.io/csaf-documentation/534    categories: [cyber, standards]535    tier: D536    country: US537    aliases: [csaf, common security advisory framework]538    discover: { rss: false }539    sensors:540      - { name: csaf releases, url: "https://github.com/oasis-tcs/csaf/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: oasis-tcs/csaf, kind: releases } }541  - id: openvex542    name: OpenVEX543    domain: openvex.dev544    homepage: https://openvex.dev545    categories: [cyber, standards, open-source]546    tier: D547    country: US548    aliases: [vex, vulnerability exploitability exchange]549    discover: { rss: false }550    sensors:551      - { name: vexctl releases, url: "https://github.com/openvex/vexctl/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: openvex/vexctl, kind: releases } }552  - id: projectdiscovery553    name: ProjectDiscovery554    domain: projectdiscovery.io555    homepage: https://projectdiscovery.io556    categories: [cyber, open-source, developer]557    tier: B558    country: US559    aliases: [nuclei, nuclei templates]560    discover: { rss: false }561    sensors:562      - { name: nuclei releases, url: "https://github.com/projectdiscovery/nuclei/releases.atom", type: GITHUB_RELEASE, connector: github, tier: C, config: { repo: projectdiscovery/nuclei, kind: releases } }563      - { name: nuclei templates releases, url: "https://github.com/projectdiscovery/nuclei-templates/releases.atom", type: GITHUB_RELEASE, connector: github, tier: B, config: { repo: projectdiscovery/nuclei-templates, kind: releases } }564  - id: owasp565    extend: true566    products:567      - { name: OWASP ZAP, type: software, aliases: [zap, zed attack proxy] }568    sensors:569      - { name: zap releases, url: "https://github.com/zaproxy/zaproxy/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: zaproxy/zaproxy, kind: releases } }570  - id: semgrep571    name: Semgrep572    domain: semgrep.dev573    homepage: https://semgrep.dev574    categories: [cyber, developer]575    tier: D576    country: US577    discover: { rss: true }578    sensors:579      - { name: releases, url: "https://github.com/semgrep/semgrep/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: semgrep/semgrep, kind: releases } }580  - id: truffle-security581    name: Truffle Security582    domain: trufflesecurity.com583    homepage: https://trufflesecurity.com584    categories: [cyber, developer]585    tier: D586    country: US587    aliases: [trufflehog]588    discover: { rss: true }589    sensors:590      - { name: trufflehog releases, url: "https://github.com/trufflesecurity/trufflehog/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: trufflesecurity/trufflehog, kind: releases } }591  - id: gitleaks592    name: Gitleaks593    domain: gitleaks.io594    homepage: https://gitleaks.io595    categories: [cyber, developer, open-source]596    tier: D597    country: US598    discover: { rss: false }599    sensors:600      - { name: releases, url: "https://github.com/gitleaks/gitleaks/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: gitleaks/gitleaks, kind: releases } }601  - id: wazuh602    name: Wazuh603    domain: wazuh.com604    homepage: https://wazuh.com605    categories: [cyber, open-source]606    tier: D607    country: US608    discover: { rss: true }609    sensors:610      - { name: releases, url: "https://github.com/wazuh/wazuh/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: wazuh/wazuh, kind: releases } }611  - id: osquery612    name: osquery613    domain: osquery.io614    homepage: https://osquery.io615    categories: [cyber, open-source]616    tier: D617    country: US618    discover: { rss: false }619    sensors:620      - { name: releases, url: "https://github.com/osquery/osquery/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: osquery/osquery, kind: releases } }621  - id: falco622    name: Falco623    domain: falco.org624    homepage: https://falco.org625    categories: [cyber, open-source, cloud]626    tier: D627    country: US628    aliases: [falcosecurity]629    discover: { rss: true }630    sensors:631      - { name: releases, url: "https://github.com/falcosecurity/falco/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: falcosecurity/falco, kind: releases } }632  - id: filigran633    name: Filigran (OpenCTI)634    domain: filigran.io635    homepage: https://filigran.io636    categories: [cyber, open-source]637    tier: D638    country: FR639    aliases: [opencti, openbas]640    discover: { rss: true }641    sensors:642      - { name: opencti releases, url: "https://github.com/OpenCTI-Platform/opencti/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: OpenCTI-Platform/opencti, kind: releases } }643  - id: sigmahq644    name: SigmaHQ645    domain: sigmahq.io646    homepage: https://sigmahq.io647    categories: [cyber, open-source]648    tier: D649    country: DE650    aliases: [sigma rules]651    discover: { rss: false }652    sensors:653      - { name: sigma releases, url: "https://github.com/SigmaHQ/sigma/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: SigmaHQ/sigma, kind: releases } }654  - id: virustotal655    name: VirusTotal656    domain: virustotal.com657    homepage: https://www.virustotal.com658    categories: [cyber]659    tier: C660    country: US661    aliases: [yara]662    products:663      - { name: YARA, type: software, aliases: [yara rules engine] }664    discover: { rss: false }665    sensors:666      - { name: blog feed, url: "https://blog.virustotal.com/feeds/posts/default", type: ATOM, connector: rss, tier: C }667      - { name: yara releases, url: "https://github.com/VirusTotal/yara/releases.atom", type: GITHUB_RELEASE, connector: github, tier: D, config: { repo: VirusTotal/yara, kind: releases } }668  - id: hibp669    extend: true670    country: AU671    aliases: [pwned, haveibeenpwned]672  - id: exploit-db673    name: Exploit Database674    domain: exploit-db.com675    homepage: https://www.exploit-db.com676    categories: [cyber]677    tier: A678    country: US679    aliases: [exploit-db, exploitdb, offsec exploit database]680    llm: false681    discover: { rss: false }682    sensors:683      - { name: latest exploits feed, url: "https://www.exploit-db.com/rss.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 50 } }684      - { name: exploitdb repository commits, url: "https://gitlab.com/exploit-database/exploitdb/-/commits/main?format=atom", type: ATOM, connector: rss, tier: B, config: { maxItems: 40 } }685  - id: ransomware-live686    name: ransomware.live687    domain: ransomware.live688    homepage: https://www.ransomware.live689    categories: [cyber]690    tier: A691    country: FR692    aliases: [ransomware live, ransomware victims tracker]693    llm: false694    discover: { rss: false }695    sensors:696      - { name: recent victims api, url: "https://api.ransomware.live/v2/recentvictims", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: victim, titleTemplate: "{group} — {victim} ({country})", urlField: url, summaryField: description, dateField: discovered, compareFields: [group, attackdate, ransom], maxItems: 100 } }697      - { name: victims feed, url: "https://www.ransomware.live/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 100 } }698  - id: abuse-ch699    name: abuse.ch700    domain: abuse.ch701    homepage: https://abuse.ch702    categories: [cyber]703    tier: A704    country: CH705    aliases: [urlhaus, threatfox, malwarebazaar, feodo tracker, sslbl]706    llm: false707    notes: "URLhaus/ThreatFox/MalwareBazaar APIs require an Auth-Key since 2025; only the Feodo Tracker JSON blocklist is anonymous."708    discover: { rss: false }709    sensors:710      - { name: feodo tracker c2 blocklist, url: "https://feodotracker.abuse.ch/downloads/ipblocklist.json", type: JSON, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: ip_address, titleTemplate: "{malware} C2 {ip_address}:{port} ({country}, {as_name})", dateField: first_seen, urlTemplate: "https://feodotracker.abuse.ch/browse/host/{key}/", compareFields: [status, last_online], maxItems: 500 } }711712  # ───────────────────────── E · National CERTs, CSIRTs & cyber agencies ─────────────────────────713  - id: ncsc-uk714    name: NCSC (UK National Cyber Security Centre)715    domain: ncsc.gov.uk716    homepage: https://www.ncsc.gov.uk717    categories: [cyber, government]718    tier: A719    weight: 1.3720    country: GB721    aliases: [ncsc, uk ncsc, national cyber security centre]722    discover: { rss: false }723    sensors:724      - { name: all content feed, url: "https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml", type: RSS, connector: rss, tier: A }725      - { name: news feed, url: "https://www.ncsc.gov.uk/api/1/services/v1/news-rss-feed.xml", type: RSS, connector: rss, tier: B }726      - { name: reports & advisories feed, url: "https://www.ncsc.gov.uk/api/1/services/v1/report-rss-feed.xml", type: RSS, connector: rss, tier: A }727      - { name: gov.uk publications atom, url: "https://www.gov.uk/government/organisations/national-cyber-security-centre.atom", type: ATOM, connector: rss, tier: C }728  - id: cccs729    name: Canadian Centre for Cyber Security730    domain: cyber.gc.ca731    homepage: https://www.cyber.gc.ca732    categories: [cyber, government]733    tier: A734    weight: 1.2735    country: CA736    aliases: [cccs, cyber centre, centre canadien pour la cybersécurité, cse cyber centre]737    discover: { rss: false }738    sensors:739      - { name: alerts & advisories atom, url: "https://www.cyber.gc.ca/api/cccs/atom/v1/get?feed=alerts_advisories&lang=en", type: ATOM, connector: rss, tier: A, config: { maxItems: 50 } }740      - { name: alertes et avis (fr), url: "https://www.cyber.gc.ca/api/cccs/atom/v1/get?feed=alerts_advisories&lang=fr", type: ATOM, connector: rss, tier: B, config: { maxItems: 50 } }741  - id: cert-fr742    name: CERT-FR (ANSSI)743    domain: cert.ssi.gouv.fr744    homepage: https://www.cert.ssi.gouv.fr745    categories: [cyber, government]746    tier: A747    weight: 1.2748    country: FR749    language: fr750    aliases: [cert-fr, anssi, agence nationale de la sécurité des systèmes d'information]751    discover: { rss: false }752    sensors:753      - { name: avis de sécurité, url: "https://www.cert.ssi.gouv.fr/avis/feed/", type: RSS, connector: rss, tier: A }754      - { name: alertes, url: "https://www.cert.ssi.gouv.fr/alerte/feed/", type: RSS, connector: rss, tier: S }755      - { name: menaces et incidents (cti), url: "https://www.cert.ssi.gouv.fr/cti/feed/", type: RSS, connector: rss, tier: B }756      - { name: indicateurs de compromission, url: "https://www.cert.ssi.gouv.fr/ioc/feed/", type: RSS, connector: rss, tier: B }757      - { name: actualités, url: "https://www.cert.ssi.gouv.fr/actualite/feed/", type: RSS, connector: rss, tier: C }758  - id: cert-bund759    name: CERT-Bund (BSI)760    domain: cert-bund.de761    homepage: https://wid.cert-bund.de/portal/wid/kurzinformationen762    categories: [cyber, government]763    tier: A764    weight: 1.2765    country: DE766    language: de767    aliases: [cert-bund, bsi, bundesamt für sicherheit in der informationstechnik, warn- und informationsdienst]768    notes: "bsi.bund.de RSS endpoints return 404; the WID portal's 'rss' endpoint returns a JSON envelope (items[])."769    discover: { rss: false }770    sensors:771      - { name: wid security advisories, url: "https://wid.cert-bund.de/content/public/securityAdvisory/rss", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: items, keyField: link, titleField: title, urlField: link, summaryField: description, dateField: pubDate, compareFields: [title], maxItems: 100 } }772  - id: cert-eu773    name: CERT-EU774    domain: cert.europa.eu775    homepage: https://cert.europa.eu776    categories: [cyber, government, international]777    tier: A778    country: EU779    aliases: [cert-eu, cybersecurity service for the union institutions]780    discover: { rss: false }781    sensors:782      - { name: security advisories feed, url: "https://cert.europa.eu/publications/security-advisories-rss", type: RSS, connector: rss, tier: A }783      - { name: threat intelligence feed, url: "https://cert.europa.eu/publications/threat-intelligence-rss", type: RSS, connector: rss, tier: B }784      - { name: security guidance feed, url: "https://cert.europa.eu/publications/security-guidance-rss", type: RSS, connector: rss, tier: C }785  - id: enisa786    extend: true787    country: EU788    products:789      - { name: EUVD, type: dataset, aliases: [european union vulnerability database, eu vulnerability database] }790    notes: "enisa.europa.eu RSS endpoints return 404; EUVD API (euvdservices) is public JSON."791    sensors:792      - { name: euvd latest vulnerabilities, url: "https://euvdservices.enisa.europa.eu/api/lastvulnerabilities", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — CVSS {baseScore} ({assigner})", summaryField: description, dateField: datePublished, urlTemplate: "https://euvd.enisa.europa.eu/vulnerability/{key}", compareFields: [baseScore, dateUpdated, exploitedSince], maxItems: 50 } }793      - { name: euvd exploited vulnerabilities, url: "https://euvdservices.enisa.europa.eu/api/exploitedvulnerabilities", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — exploited since {exploitedSince} (CVSS {baseScore})", summaryField: description, dateField: dateUpdated, urlTemplate: "https://euvd.enisa.europa.eu/vulnerability/{key}", compareFields: [baseScore, exploitedSince], maxItems: 50 } }794      - { name: euvd critical vulnerabilities, url: "https://euvdservices.enisa.europa.eu/api/criticalvulnerabilities", type: REST_API, connector: jsonlist, tier: A, config: { itemsPath: "", keyField: id, titleTemplate: "{id} — critical CVSS {baseScore}", summaryField: description, dateField: datePublished, urlTemplate: "https://euvd.enisa.europa.eu/vulnerability/{key}", compareFields: [baseScore, dateUpdated], maxItems: 50 } }795  - id: europol796    extend: true797    country: EU798  - id: jpcert799    name: JPCERT/CC800    domain: jpcert.or.jp801    homepage: https://www.jpcert.or.jp/english/802    categories: [cyber]803    tier: A804    country: JP805    aliases: [jpcert, japan computer emergency response team coordination center]806    discover: { rss: false }807    sensors:808      - { name: english feed, url: "https://www.jpcert.or.jp/english/rss/jpcert-en.rdf", type: RSS, connector: rss, tier: A }809  - id: jvn810    name: JVN (Japan Vulnerability Notes)811    domain: jvn.jp812    homepage: https://jvn.jp/en/813    categories: [cyber, government]814    tier: A815    country: JP816    aliases: [jvn, jvndb, japan vulnerability notes]817    llm: false818    discover: { rss: false }819    sensors:820      - { name: jvn notes feed, url: "https://jvn.jp/en/rss/jvn.rdf", type: RSS, connector: rss, tier: A }821      - { name: jvndb new entries feed, url: "https://jvndb.jvn.jp/en/rss/jvndb_new.rdf", type: RSS, connector: rss, tier: B, config: { maxItems: 100 } }822  - id: ipa-japan823    name: IPA (Information-technology Promotion Agency, Japan)824    domain: ipa.go.jp825    homepage: https://www.ipa.go.jp/security/826    categories: [cyber, government]827    tier: B828    country: JP829    language: ja830    aliases: [ipa, 情報処理推進機構]831    discover: { rss: false }832    sensors:833      - { name: security alerts feed, url: "https://www.ipa.go.jp/security/rss/alert.rdf", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }834  - id: ncsc-nl835    name: NCSC-NL836    domain: ncsc.nl837    homepage: https://www.ncsc.nl838    categories: [cyber, government]839    tier: A840    country: NL841    aliases: [ncsc-nl, nationaal cyber security centrum]842    discover: { rss: false }843    sensors:844      - { name: security advisories feed, url: "https://advisories.ncsc.nl/rss/advisories", type: RSS, connector: rss, tier: A }845  - id: incibe846    name: INCIBE-CERT847    domain: incibe.es848    homepage: https://www.incibe.es/en/incibe-cert849    categories: [cyber, government]850    tier: A851    country: ES852    aliases: [incibe, incibe-cert, instituto nacional de ciberseguridad]853    discover: { rss: false }854    sensors:855      - { name: security advisories feed (en), url: "https://www.incibe.es/en/incibe-cert/early-warning/security-advisories/feed", type: RSS, connector: rss, tier: A }856      - { name: avisos sci (ics), url: "https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/feed", type: RSS, connector: rss, tier: B }857      - { name: blog feed, url: "https://www.incibe.es/incibe-cert/blog/feed", type: RSS, connector: rss, tier: C }858  - id: cert-pl859    name: CERT Polska860    domain: cert.pl861    homepage: https://cert.pl/en/862    categories: [cyber, government]863    tier: B864    country: PL865    aliases: [cert polska, cert.pl, nask]866    discover: { rss: false }867    sensors:868      - { name: english feed, url: "https://cert.pl/en/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }869  - id: cert-at870    name: CERT.at871    domain: cert.at872    homepage: https://www.cert.at873    categories: [cyber, government]874    tier: A875    country: AT876    language: de877    aliases: [cert.at, govcert austria]878    discover: { rss: false }879    sensors:880      - { name: warnungen, url: "https://www.cert.at/cert-at.de.warnings.rss_2.0.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 50 } }881      - { name: alle meldungen, url: "https://www.cert.at/cert-at.de.all.rss_2.0.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }882  - id: ccb-belgium883    name: Centre for Cybersecurity Belgium884    domain: ccb.belgium.be885    homepage: https://ccb.belgium.be886    categories: [cyber, government]887    tier: A888    country: BE889    aliases: [ccb, cert.be, centre for cyber security belgium]890    discover: { rss: false }891    sensors:892      - { name: advisories feed, url: "https://ccb.belgium.be/advisories.xml", type: RSS, connector: rss, tier: A }893      - { name: news feed, url: "https://ccb.belgium.be/news.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }894  - id: cert-se895    name: CERT-SE896    domain: cert.se897    homepage: https://www.cert.se898    categories: [cyber, government]899    tier: B900    country: SE901    language: sv902    aliases: [cert-se, msb cert]903    discover: { rss: false }904    sensors:905      - { name: feed, url: "https://www.cert.se/feed/rss.xml", type: RSS, connector: rss, tier: B }906  - id: si-cert907    name: SI-CERT908    domain: cert.si909    homepage: https://www.cert.si/en/910    categories: [cyber, government]911    tier: C912    country: SI913    aliases: [si-cert, slovenian computer emergency response team]914    discover: { rss: false }915    sensors:916      - { name: english feed, url: "https://www.cert.si/en/feed/", type: RSS, connector: rss, tier: C }917  - id: cert-hr918    name: CERT.hr (CARNET)919    domain: cert.hr920    homepage: https://www.cert.hr921    categories: [cyber, government]922    tier: C923    country: HR924    language: hr925    aliases: [cert.hr, nacionalni cert]926    discover: { rss: false }927    sensors:928      - { name: feed, url: "https://www.cert.hr/feed/", type: RSS, connector: rss, tier: C }929  - id: csirt-sk930    name: CSIRT.SK931    domain: csirt.sk932    homepage: https://www.csirt.sk933    categories: [cyber, government]934    tier: C935    country: SK936    language: sk937    aliases: [csirt.sk, sk-cert]938    llm: false939    discover: { rss: false }940    sensors:941      - { name: feed, url: "https://www.csirt.sk/feed", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }942  - id: dnsc-romania943    name: DNSC (Romanian National Cyber Security Directorate)944    domain: dnsc.ro945    homepage: https://www.dnsc.ro946    categories: [cyber, government]947    tier: C948    country: RO949    language: ro950    aliases: [dnsc, cert-ro, directoratul național de securitate cibernetică]951    discover: { rss: false }952    sensors:953      - { name: feed, url: "https://www.dnsc.ro/feed", type: RSS, connector: rss, tier: C }954  - id: cert-ua955    name: CERT-UA956    domain: cert.gov.ua957    homepage: https://cert.gov.ua958    categories: [cyber, government]959    tier: A960    country: UA961    language: uk962    aliases: [cert-ua, урядова команда реагування на комп'ютерні надзвичайні події україни]963    discover: { rss: false }964    sensors:965      - { name: articles feed, url: "https://cert.gov.ua/api/articles/rss", type: RSS, connector: rss, tier: A }966  - id: kisa-krcert967    name: KISA KrCERT/CC968    domain: boho.or.kr969    homepage: https://www.boho.or.kr970    categories: [cyber, government]971    tier: B972    country: KR973    language: ko974    aliases: [krcert, kisa, korea internet & security agency]975    discover: { rss: false }976    sensors:977      - { name: security notices feed, url: "https://www.boho.or.kr/kr/rss.do?bbsId=B0000133", type: RSS, connector: rss, tier: B }978  - id: cert-br979    name: CERT.br980    domain: cert.br981    homepage: https://www.cert.br982    categories: [cyber]983    tier: C984    country: BR985    language: pt986    aliases: [cert.br, nic.br cert]987    discover: { rss: false }988    sensors:989      - { name: feed, url: "https://cert.br/rss/certbr-rss.xml", type: RSS, connector: rss, tier: C }990  - id: cert-ae991    name: UAE Cyber Security Council (aeCERT)992    domain: cert.ae993    homepage: https://www.cert.ae994    categories: [cyber, government]995    tier: C996    country: AE997    aliases: [aecert, uae cert]998    discover: { rss: false }999    sensors:1000      - { name: feed, url: "https://www.cert.ae/feed/", type: RSS, connector: rss, tier: C }1001  - id: traficom-ncsc-fi1002    name: NCSC-FI (Traficom)1003    domain: kyberturvallisuuskeskus.fi1004    homepage: https://www.kyberturvallisuuskeskus.fi/en/1005    categories: [cyber, government]1006    tier: B1007    country: FI1008    aliases: [ncsc-fi, kyberturvallisuuskeskus, finnish transport and communications agency cyber security centre]1009    discover: { rss: false }1010    sensors:1011      - { name: english feed, url: "https://www.kyberturvallisuuskeskus.fi/feed/rss/en", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1012  - id: cnil1013    extend: true1014    sensors:1015      - { name: english feed, url: "https://www.cnil.fr/en/rss.xml", type: RSS, connector: rss, tier: C }10161017  # ───────────────────────── F · Threat-intelligence & security research vendors ─────────────────────────1018  - id: kaspersky1019    name: Kaspersky1020    domain: kaspersky.com1021    homepage: https://www.kaspersky.com1022    categories: [cyber]1023    tier: B1024    country: RU1025    aliases: [securelist, kaspersky lab, great]1026    products:1027      - { name: Securelist, type: service, aliases: [securelist blog] }1028      - { name: Kaspersky ICS CERT, type: service, aliases: [ics cert kaspersky] }1029    discover: { rss: false }1030    sensors:1031      - { name: securelist feed, url: "https://securelist.com/feed/", type: RSS, connector: rss, tier: B }1032      - { name: securelist apt reports, url: "https://securelist.com/category/apt-reports/feed/", type: RSS, connector: rss, tier: B }1033      - { name: ics cert feed, url: "https://ics-cert.kaspersky.com/feed/", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1034      - { name: daily blog feed, url: "https://www.kaspersky.com/blog/feed/", type: RSS, connector: rss, tier: C }1035  - id: eset1036    name: ESET1037    domain: eset.com1038    homepage: https://www.eset.com1039    categories: [cyber]1040    tier: B1041    country: SK1042    aliases: [welivesecurity, eset research]1043    products:1044      - { name: WeLiveSecurity, type: service, aliases: [we live security] }1045    discover: { rss: false }1046    sensors:1047      - { name: welivesecurity feed, url: "https://www.welivesecurity.com/en/rss/feed/", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1048  - id: check-point1049    name: Check Point Software1050    domain: checkpoint.com1051    homepage: https://www.checkpoint.com1052    categories: [cyber]1053    tier: B1054    country: IL1055    aliases: [check point research, cpr, checkpoint]1056    products:1057      - { name: Check Point Research, type: service, aliases: [cpr] }1058    discover: { rss: false }1059    sensors:1060      - { name: research feed, url: "https://research.checkpoint.com/feed/", type: RSS, connector: rss, tier: B }1061      - { name: blog feed, url: "https://blog.checkpoint.com/feed/", type: RSS, connector: rss, tier: C }1062  - id: recorded-future1063    name: Recorded Future1064    domain: recordedfuture.com1065    homepage: https://www.recordedfuture.com1066    categories: [cyber]1067    tier: B1068    country: US1069    aliases: [insikt group]1070    discover: { rss: false }1071    sensors:1072      - { name: blog & research feed, url: "https://www.recordedfuture.com/feed", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1073  - id: greynoise1074    name: GreyNoise Intelligence1075    domain: greynoise.io1076    homepage: https://www.greynoise.io1077    categories: [cyber]1078    tier: B1079    country: US1080    aliases: [greynoise]1081    discover: { rss: false }1082    sensors:1083      - { name: blog feed, url: "https://www.greynoise.io/blog/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1084  - id: huntress1085    name: Huntress1086    domain: huntress.com1087    homepage: https://www.huntress.com1088    categories: [cyber]1089    tier: B1090    country: US1091    discover: { rss: false }1092    sensors:1093      - { name: blog feed, url: "https://www.huntress.com/blog/rss.xml", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1094  - id: datadog1095    extend: true1096    categories: [cyber]1097    products:1098      - { name: Datadog Security Labs, type: service, aliases: [security labs] }1099    sensors:1100      - { name: security labs feed, url: "https://securitylabs.datadoghq.com/rss/feed.xml", type: RSS, connector: rss, tier: B }1101  - id: orca-security1102    name: Orca Security1103    domain: orca.security1104    homepage: https://orca.security1105    categories: [cyber, cloud]1106    tier: C1107    country: US1108    aliases: [orca]1109    discover: { rss: false }1110    sensors:1111      - { name: blog feed, url: "https://orca.security/resources/blog/feed/", type: RSS, connector: rss, tier: C }1112  - id: qualys1113    name: Qualys1114    domain: qualys.com1115    homepage: https://www.qualys.com1116    categories: [cyber, enterprise]1117    tier: B1118    country: US1119    aliases: [qualys tru, threat research unit]1120    discover: { rss: false }1121    sensors:1122      - { name: blog feed, url: "https://blog.qualys.com/feed", type: RSS, connector: rss, tier: B }1123      - { name: threatprotect feed, url: "https://threatprotect.qualys.com/feed/", type: RSS, connector: rss, tier: A }1124  - id: bitdefender1125    name: Bitdefender1126    domain: bitdefender.com1127    homepage: https://www.bitdefender.com1128    categories: [cyber, consumer-tech]1129    tier: C1130    country: RO1131    aliases: [bitdefender labs, hot for security]1132    discover: { rss: false }1133    sensors:1134      - { name: labs feed, url: "https://www.bitdefender.com/nuxt/api/en-us/rss/labs/", type: RSS, connector: rss, tier: C }1135      - { name: hot for security feed, url: "https://www.bitdefender.com/nuxt/api/en-us/rss/hotforsecurity/", type: RSS, connector: rss, tier: C }1136  - id: avast1137    name: Avast (Gen Digital)1138    domain: avast.com1139    homepage: https://www.avast.com1140    categories: [cyber, consumer-tech]1141    tier: C1142    country: CZ1143    aliases: [gen digital, avast threat labs, norton lifelock]1144    discover: { rss: false }1145    sensors:1146      - { name: blog feed, url: "https://blog.avast.com/rss.xml", type: RSS, connector: rss, tier: C }1147  - id: cybereason1148    name: Cybereason1149    domain: cybereason.com1150    homepage: https://www.cybereason.com1151    categories: [cyber]1152    tier: C1153    country: US1154    discover: { rss: false }1155    sensors:1156      - { name: blog feed, url: "https://www.cybereason.com/blog/rss.xml", type: RSS, connector: rss, tier: C }1157  - id: arctic-wolf1158    name: Arctic Wolf1159    domain: arcticwolf.com1160    homepage: https://arcticwolf.com1161    categories: [cyber]1162    tier: C1163    country: US1164    aliases: [arctic wolf labs]1165    discover: { rss: false }1166    sensors:1167      - { name: feed, url: "https://arcticwolf.com/feed/", type: RSS, connector: rss, tier: C }1168  - id: forescout1169    name: Forescout1170    domain: forescout.com1171    homepage: https://www.forescout.com1172    categories: [cyber]1173    tier: C1174    country: US1175    aliases: [vedere labs]1176    discover: { rss: false }1177    sensors:1178      - { name: blog feed, url: "https://www.forescout.com/feed/", type: RSS, connector: rss, tier: C }1179  - id: censys1180    name: Censys1181    domain: censys.com1182    homepage: https://censys.com1183    categories: [cyber, internet]1184    tier: C1185    country: US1186    discover: { rss: false }1187    sensors:1188      - { name: blog feed, url: "https://censys.com/feed/", type: RSS, connector: rss, tier: C }1189  - id: shodan1190    name: Shodan1191    domain: shodan.io1192    homepage: https://www.shodan.io1193    categories: [cyber, internet]1194    tier: C1195    country: US1196    discover: { rss: false }1197    sensors:1198      - { name: blog feed, url: "https://blog.shodan.io/rss/", type: RSS, connector: rss, tier: C }1199  - id: cloudsek1200    name: CloudSEK1201    domain: cloudsek.com1202    homepage: https://www.cloudsek.com1203    categories: [cyber]1204    tier: C1205    country: IN1206    discover: { rss: false }1207    sensors:1208      - { name: blog feed, url: "https://www.cloudsek.com/blog/rss.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }1209  - id: intel4711210    name: Intel 4711211    domain: intel471.com1212    homepage: https://www.intel471.com1213    categories: [cyber]1214    tier: C1215    country: US1216    discover: { rss: false }1217    sensors:1218      - { name: blog feed, url: "https://www.intel471.com/blog/feed", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }1219  - id: flashpoint1220    name: Flashpoint1221    domain: flashpoint.io1222    homepage: https://flashpoint.io1223    categories: [cyber]1224    tier: C1225    country: US1226    discover: { rss: false }1227    sensors:1228      - { name: blog feed, url: "https://flashpoint.io/blog/feed/", type: RSS, connector: rss, tier: C }1229  - id: socradar1230    name: SOCRadar1231    domain: socradar.io1232    homepage: https://socradar.io1233    categories: [cyber]1234    tier: C1235    country: US1236    discover: { rss: false }1237    sensors:1238      - { name: blog feed, url: "https://socradar.io/feed/", type: RSS, connector: rss, tier: C }1239  - id: eclecticiq1240    name: EclecticIQ1241    domain: eclecticiq.com1242    homepage: https://www.eclecticiq.com1243    categories: [cyber]1244    tier: C1245    country: NL1246    discover: { rss: false }1247    sensors:1248      - { name: blog feed, url: "https://blog.eclecticiq.com/rss.xml", type: RSS, connector: rss, tier: C }1249  - id: sygnia1250    name: Sygnia1251    domain: sygnia.co1252    homepage: https://www.sygnia.co1253    categories: [cyber]1254    tier: C1255    country: IL1256    discover: { rss: false }1257    sensors:1258      - { name: feed, url: "https://www.sygnia.co/feed/", type: RSS, connector: rss, tier: C }1259  - id: resecurity1260    name: Resecurity1261    domain: resecurity.com1262    homepage: https://www.resecurity.com1263    categories: [cyber]1264    tier: C1265    country: US1266    discover: { rss: false }1267    sensors:1268      - { name: feed, url: "https://www.resecurity.com/feed", type: RSS, connector: rss, tier: C }1269  - id: ahnlab1270    name: AhnLab1271    domain: ahnlab.com1272    homepage: https://asec.ahnlab.com/en/1273    categories: [cyber]1274    tier: C1275    country: KR1276    aliases: [asec, ahnlab security intelligence center]1277    discover: { rss: false }1278    sensors:1279      - { name: asec english feed, url: "https://asec.ahnlab.com/en/feed/", type: RSS, connector: rss, tier: C }1280  - id: any-run1281    name: ANY.RUN1282    domain: any.run1283    homepage: https://any.run1284    categories: [cyber]1285    tier: C1286    country: AE1287    aliases: [anyrun sandbox]1288    discover: { rss: false }1289    sensors:1290      - { name: blog feed, url: "https://any.run/cybersecurity-blog/feed/", type: RSS, connector: rss, tier: C }1291  - id: infoblox1292    name: Infoblox1293    domain: infoblox.com1294    homepage: https://www.infoblox.com1295    categories: [cyber, internet]1296    tier: C1297    country: US1298    aliases: [infoblox threat intel]1299    discover: { rss: false }1300    sensors:1301      - { name: blog feed, url: "https://www.infoblox.com/blog/feed/", type: RSS, connector: rss, tier: C }1302  - id: exodus-intelligence1303    name: Exodus Intelligence1304    domain: exodusintel.com1305    homepage: https://www.exodusintel.com1306    categories: [cyber]1307    tier: C1308    country: US1309    discover: { rss: false }1310    sensors:1311      - { name: blog feed, url: "https://blog.exodusintel.com/feed/", type: RSS, connector: rss, tier: C }1312  - id: reversinglabs1313    name: ReversingLabs1314    domain: reversinglabs.com1315    homepage: https://www.reversinglabs.com1316    categories: [cyber, developer]1317    tier: C1318    country: US1319    discover: { rss: false }1320    sensors:1321      - { name: blog feed, url: "https://www.reversinglabs.com/blog/rss.xml", type: RSS, connector: rss, tier: C }1322  - id: endor-labs1323    name: Endor Labs1324    domain: endorlabs.com1325    homepage: https://www.endorlabs.com1326    categories: [cyber, developer]1327    tier: C1328    country: US1329    discover: { rss: false }1330    sensors:1331      - { name: learn feed, url: "https://www.endorlabs.com/learn/rss.xml", type: RSS, connector: rss, tier: C, config: { maxItems: 50 } }1332  - id: legit-security1333    name: Legit Security1334    domain: legitsecurity.com1335    homepage: https://www.legitsecurity.com1336    categories: [cyber, developer]1337    tier: D1338    country: US1339    discover: { rss: false }1340    sensors:1341      - { name: blog feed, url: "https://www.legitsecurity.com/blog/rss.xml", type: RSS, connector: rss, tier: D }1342  - id: cycode1343    name: Cycode1344    domain: cycode.com1345    homepage: https://cycode.com1346    categories: [cyber, developer]1347    tier: D1348    country: US1349    discover: { rss: false }1350    sensors:1351      - { name: feed, url: "https://cycode.com/feed/", type: RSS, connector: rss, tier: D }1352  - id: mend1353    name: Mend.io1354    domain: mend.io1355    homepage: https://www.mend.io1356    categories: [cyber, developer]1357    tier: D1358    country: IL1359    aliases: [whitesource, renovate]1360    discover: { rss: false }1361    sensors:1362      - { name: blog feed, url: "https://www.mend.io/blog/feed/", type: RSS, connector: rss, tier: D }1363  - id: checkmarx1364    name: Checkmarx1365    domain: checkmarx.com1366    homepage: https://checkmarx.com1367    categories: [cyber, developer]1368    tier: D1369    country: US1370    discover: { rss: false }1371    sensors:1372      - { name: feed, url: "https://checkmarx.com/feed/", type: RSS, connector: rss, tier: D }1373  - id: trail-of-bits1374    name: Trail of Bits1375    domain: trailofbits.com1376    homepage: https://www.trailofbits.com1377    categories: [cyber, developer]1378    tier: C1379    country: US1380    discover: { rss: false }1381    sensors:1382      - { name: blog feed, url: "https://blog.trailofbits.com/index.xml", type: RSS, connector: rss, tier: C }1383  - id: bishop-fox1384    name: Bishop Fox1385    domain: bishopfox.com1386    homepage: https://bishopfox.com1387    categories: [cyber]1388    tier: C1389    country: US1390    discover: { rss: false }1391    sensors:1392      - { name: blog feed, url: "https://bishopfox.com/feeds/blog.rss", type: RSS, connector: rss, tier: C }1393  - id: praetorian1394    name: Praetorian1395    domain: praetorian.com1396    homepage: https://www.praetorian.com1397    categories: [cyber]1398    tier: D1399    country: US1400    discover: { rss: false }1401    sensors:1402      - { name: blog feed, url: "https://www.praetorian.com/blog/feed/", type: RSS, connector: rss, tier: D }1403  - id: synacktiv1404    name: Synacktiv1405    domain: synacktiv.com1406    homepage: https://www.synacktiv.com1407    categories: [cyber]1408    tier: C1409    country: FR1410    discover: { rss: false }1411    sensors:1412      - { name: english blog feed, url: "https://www.synacktiv.com/en/feed/lastblog.xml", type: RSS, connector: rss, tier: C }1413  - id: assetnote1414    name: Assetnote (Searchlight Cyber)1415    domain: assetnote.io1416    homepage: https://www.assetnote.io1417    categories: [cyber]1418    tier: C1419    country: AU1420    discover: { rss: false }1421    sensors:1422      - { name: research blog feed, url: "https://blog.assetnote.io/feed.xml", type: RSS, connector: rss, tier: C }1423  - id: horizon31424    name: Horizon3.ai1425    domain: horizon3.ai1426    homepage: https://horizon3.ai1427    categories: [cyber]1428    tier: C1429    country: US1430    aliases: [horizon3 attack team, nodezero]1431    discover: { rss: false }1432    sensors:1433      - { name: feed, url: "https://horizon3.ai/feed/", type: RSS, connector: rss, tier: C }1434  - id: watchtowr1435    name: watchTowr1436    domain: watchtowr.com1437    homepage: https://watchtowr.com1438    categories: [cyber]1439    tier: B1440    country: SG1441    aliases: [watchtowr labs]1442    discover: { rss: false }1443    sensors:1444      - { name: labs feed, url: "https://labs.watchtowr.com/rss/", type: RSS, connector: rss, tier: B }1445  - id: intigriti1446    name: Intigriti1447    domain: intigriti.com1448    homepage: https://www.intigriti.com1449    categories: [cyber]1450    tier: D1451    country: BE1452    discover: { rss: false }1453    sensors:1454      - { name: blog feed, url: "https://www.intigriti.com/blog/feed", type: ATOM, connector: rss, tier: D }1455  - id: mdsec1456    name: MDSec1457    domain: mdsec.co.uk1458    homepage: https://www.mdsec.co.uk1459    categories: [cyber]1460    tier: C1461    country: GB1462    discover: { rss: false }1463    sensors:1464      - { name: feed, url: "https://www.mdsec.co.uk/feed/", type: RSS, connector: rss, tier: C }1465  - id: pentest-partners1466    name: Pen Test Partners1467    domain: pentestpartners.com1468    homepage: https://www.pentestpartners.com1469    categories: [cyber]1470    tier: D1471    country: GB1472    discover: { rss: false }1473    sensors:1474      - { name: feed, url: "https://www.pentestpartners.com/feed/", type: RSS, connector: rss, tier: D }1475  - id: portswigger1476    name: PortSwigger1477    domain: portswigger.net1478    homepage: https://portswigger.net1479    categories: [cyber, developer]1480    tier: C1481    country: GB1482    aliases: [burp suite, portswigger research]1483    discover: { rss: false }1484    sensors:1485      - { name: research feed, url: "https://portswigger.net/research/rss", type: RSS, connector: rss, tier: C }1486  - id: cloudflare1487    extend: true1488    sensors:1489      - { name: security tag feed, url: "https://blog.cloudflare.com/tag/security/rss/", type: RSS, connector: rss, tier: B }1490      - { name: vulnerabilities tag feed, url: "https://blog.cloudflare.com/tag/vulnerabilities/rss/", type: RSS, connector: rss, tier: A }1491      - { name: post-mortem tag feed, url: "https://blog.cloudflare.com/tag/post-mortem/rss/", type: RSS, connector: rss, tier: A }1492  - id: proofpoint1493    extend: true1494    country: US1495    sensors:1496      - { name: threat insight blog feed, url: "https://www.proofpoint.com/us/threat-insight-blog.xml", type: RSS, connector: rss, tier: B }1497  - id: zscaler1498    extend: true1499    products:1500      - { name: ThreatLabz, type: service, aliases: [zscaler threatlabz] }1501    sensors:1502      - { name: security research blog feed, url: "https://www.zscaler.com/blogs/feeds/security-research", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1503  - id: akamai1504    extend: true1505    notes: "akamai.com blog RSS paths return 403 (Akamai bot manager); the FeedBurner mirror is the only working feed."1506  - id: sans-isc1507    extend: true1508    country: US1509    sensors:1510      - { name: diaries feed (short), url: "https://isc.sans.edu/rssfeed.xml", type: RSS, connector: rss, tier: A }1511  - id: seclists1512    name: SecLists.org (Full Disclosure / oss-security)1513    domain: seclists.org1514    homepage: https://seclists.org1515    categories: [cyber, open-source]1516    tier: B1517    country: US1518    aliases: [full disclosure, oss-security, seclists]1519    first_party: false1520    llm: false1521    discover: { rss: false }1522    sensors:1523      - { name: full disclosure list feed, url: "https://seclists.org/rss/fulldisclosure.rss", type: RSS, connector: rss, tier: B }1524      - { name: oss-security list feed, url: "https://seclists.org/rss/oss-sec.rss", type: RSS, connector: rss, tier: A }15251526  # ───────────────────────── G · Security media & independent researchers (first_party: false) ─────────────────────────1527  - id: bleepingcomputer1528    extend: true1529    country: US1530    first_party: false1531  - id: krebs-on-security1532    extend: true1533    country: US1534    first_party: false1535  - id: the-hacker-news1536    extend: true1537    country: IN1538    first_party: false1539  - id: the-record1540    extend: true1541    country: US1542    first_party: false1543  - id: securityweek1544    name: SecurityWeek1545    domain: securityweek.com1546    homepage: https://www.securityweek.com1547    categories: [news, media, cyber]1548    tier: A1549    weight: 0.81550    country: US1551    first_party: false1552    llm: false1553    discover: { rss: false }1554    sensors:1555      - { name: feed, url: "https://www.securityweek.com/feed/", type: RSS, connector: rss, tier: A }1556  - id: dark-reading1557    name: Dark Reading1558    domain: darkreading.com1559    homepage: https://www.darkreading.com1560    categories: [news, media, cyber]1561    tier: A1562    weight: 0.81563    country: US1564    first_party: false1565    llm: false1566    discover: { rss: false }1567    sensors:1568      - { name: feed, url: "https://www.darkreading.com/rss.xml", type: RSS, connector: rss, tier: A, config: { maxItems: 50 } }1569  - id: cyberscoop1570    name: CyberScoop1571    domain: cyberscoop.com1572    homepage: https://cyberscoop.com1573    categories: [news, media, cyber, politics]1574    tier: B1575    weight: 0.81576    country: US1577    first_party: false1578    llm: false1579    discover: { rss: false }1580    sensors:1581      - { name: feed, url: "https://cyberscoop.com/feed/", type: RSS, connector: rss, tier: B }1582  - id: risky-business1583    name: Risky Business1584    domain: risky.biz1585    homepage: https://risky.biz1586    categories: [news, media, cyber]1587    tier: B1588    weight: 0.71589    country: AU1590    first_party: false1591    llm: false1592    aliases: [risky biz, risky business news]1593    discover: { rss: false }1594    sensors:1595      - { name: podcast & newsletter feed, url: "https://risky.biz/rss.xml", type: RSS, connector: rss, tier: B }1596      - { name: risky business news feed, url: "https://news.risky.biz/rss/", type: RSS, connector: rss, tier: B }1597  - id: infosecurity-magazine1598    name: Infosecurity Magazine1599    domain: infosecurity-magazine.com1600    homepage: https://www.infosecurity-magazine.com1601    categories: [news, media, cyber]1602    tier: B1603    weight: 0.71604    country: GB1605    first_party: false1606    llm: false1607    discover: { rss: false }1608    sensors:1609      - { name: news feed, url: "https://www.infosecurity-magazine.com/rss/news/", type: RSS, connector: rss, tier: B, config: { maxItems: 50 } }1610  - id: help-net-security1611    name: Help Net Security1612    domain: helpnetsecurity.com1613    homepage: https://www.helpnetsecurity.com1614    categories: [news, media, cyber]1615    tier: B1616    weight: 0.61617    country: HR1618    first_party: false1619    llm: false1620    discover: { rss: false }1621    sensors:1622      - { name: feed, url: "https://www.helpnetsecurity.com/feed/", type: RSS, connector: rss, tier: B }1623  - id: security-affairs1624    name: Security Affairs1625    domain: securityaffairs.com1626    homepage: https://securityaffairs.com1627    categories: [news, media, cyber]1628    tier: B1629    weight: 0.61630    country: IT1631    first_party: false1632    llm: false1633    discover: { rss: false }1634    sensors:1635      - { name: feed, url: "https://securityaffairs.com/feed", type: RSS, connector: rss, tier: B }1636  - id: cso-online1637    name: CSO Online1638    domain: csoonline.com1639    homepage: https://www.csoonline.com1640    categories: [news, media, cyber]1641    tier: B1642    weight: 0.71643    country: US1644    first_party: false1645    llm: false1646    aliases: [cso]1647    discover: { rss: false }1648    sensors:1649      - { name: feed, url: "https://www.csoonline.com/feed/", type: RSS, connector: rss, tier: B }1650  - id: cybersecurity-dive1651    name: Cybersecurity Dive1652    domain: cybersecuritydive.com1653    homepage: https://www.cybersecuritydive.com1654    categories: [news, media, cyber]1655    tier: B1656    weight: 0.71657    country: US1658    first_party: false1659    llm: false1660    discover: { rss: false }1661    sensors:1662      - { name: news feed, url: "https://www.cybersecuritydive.com/feeds/news/", type: RSS, connector: rss, tier: B }1663  - id: databreaches-net1664    name: DataBreaches.net1665    domain: databreaches.net1666    homepage: https://databreaches.net1667    categories: [news, media, cyber]1668    tier: B1669    weight: 0.61670    country: US1671    first_party: false1672    llm: false1673    aliases: [databreaches, dissent doe]1674    discover: { rss: false }1675    sensors:1676      - { name: feed, url: "https://databreaches.net/feed/", type: RSS, connector: rss, tier: B }1677  - id: schneier-on-security1678    name: Schneier on Security1679    domain: schneier.com1680    homepage: https://www.schneier.com1681    categories: [media, cyber]1682    tier: C1683    weight: 0.71684    country: US1685    first_party: false1686    aliases: [bruce schneier]1687    discover: { rss: false }1688    sensors:1689      - { name: feed, url: "https://www.schneier.com/feed/atom/", type: ATOM, connector: rss, tier: C }1690  - id: troy-hunt1691    name: Troy Hunt1692    domain: troyhunt.com1693    homepage: https://www.troyhunt.com1694    categories: [media, cyber]1695    tier: C1696    weight: 0.61697    country: AU1698    first_party: false1699    discover: { rss: false }1700    sensors:1701      - { name: feed, url: "https://www.troyhunt.com/rss/", type: RSS, connector: rss, tier: C }1702  - id: graham-cluley1703    name: Graham Cluley1704    domain: grahamcluley.com1705    homepage: https://grahamcluley.com1706    categories: [media, cyber]1707    tier: C1708    weight: 0.51709    country: GB1710    first_party: false1711    aliases: [smashing security]1712    discover: { rss: false }1713    sensors:1714      - { name: feed, url: "https://grahamcluley.com/feed/", type: RSS, connector: rss, tier: C }1715  - id: heise-security1716    name: heise Security1717    domain: heise.de1718    homepage: https://www.heise.de/security/1719    categories: [news, media, cyber]1720    tier: B1721    weight: 0.71722    country: DE1723    language: de1724    first_party: false1725    llm: false1726    aliases: [heise online security, heise]1727    discover: { rss: false }1728    sensors:1729      - { name: security news feed, url: "https://www.heise.de/security/feed.xml", type: ATOM, connector: rss, tier: B }1730      - { name: security alerts feed, url: "https://www.heise.de/security/Alerts/feed.xml", type: ATOM, connector: rss, tier: A }1731  - id: golem-security1732    name: Golem.de Security1733    domain: golem.de1734    homepage: https://www.golem.de/specials/security/1735    categories: [news, media, cyber]1736    tier: C1737    weight: 0.51738    country: DE1739    language: de1740    first_party: false1741    llm: false1742    discover: { rss: false }1743    sensors:1744      - { name: security feed, url: "https://rss.golem.de/rss.php?feed=RSS2.0&ms=security", type: RSS, connector: rss, tier: C }1745  - id: zataz1746    name: ZATAZ1747    domain: zataz.com1748    homepage: https://www.zataz.com1749    categories: [news, media, cyber]1750    tier: C1751    weight: 0.51752    country: FR1753    language: fr1754    first_party: false1755    llm: false1756    discover: { rss: false }1757    sensors:1758      - { name: feed, url: "https://www.zataz.com/feed/", type: RSS, connector: rss, tier: C }1759  - id: the-register1760    extend: true1761    sensors:1762      - { name: security headlines, url: "https://www.theregister.com/security/headlines.atom", type: ATOM, connector: rss, tier: B, config: { maxItems: 50 } }1763  - id: ars-technica1764    extend: true1765    sensors:1766      - { name: security feed, url: "https://arstechnica.com/security/feed/", type: RSS, connector: rss, tier: B }1767  - id: wired1768    extend: true1769    sensors:1770      - { name: security feed, url: "https://www.wired.com/feed/category/security/latest/rss", type: RSS, connector: rss, tier: B }1771