From 898909e0617739c4119b7571b9ef9d218b0968ee Mon Sep 17 00:00:00 2001 From: bot Date: Wed, 29 Apr 2026 10:28:09 +0300 Subject: [PATCH] 48h article window, add CISA feeds, remove dead feeds --- feeds/news_feeds.json | 1 - feeds/research_feeds.json | 3 --- feeds/threat_intel_feeds.json | 3 +++ rss_manager.py | 10 +++++----- 4 files changed, 8 insertions(+), 9 deletions(-) diff --git a/feeds/news_feeds.json b/feeds/news_feeds.json index 3e0fbdb..c7c58c3 100644 --- a/feeds/news_feeds.json +++ b/feeds/news_feeds.json @@ -13,7 +13,6 @@ "Cyber Security Hub": "https://www.cshub.com/rss-feeds", "PortSwigger Daily Swig": "https://portswigger.net/daily-swig/rss", "Qualys": "https://blog.qualys.com/feed", - "Rapid7": "https://blog.rapid7.com/feed", "0x44 Security Blog": "https://0x44.cc/feed.xml", "NCSC UK Blog": "https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml", "FBI Cyber Feeds": "https://www.fbi.gov/feeds" diff --git a/feeds/research_feeds.json b/feeds/research_feeds.json index d80f36d..3696bd1 100644 --- a/feeds/research_feeds.json +++ b/feeds/research_feeds.json @@ -14,15 +14,12 @@ "Check Point Research": "https://research.checkpoint.com/feed/", "RET2 Systems Blog": "https://blog.ret2.io/feed.xml", "secret club": "https://secret.club/feed.xml", - "j00ru vx tech": "https://j00ru.vexillium.org/feed/", "Connor McGarr": "https://connormcgarr.github.io/feed.xml", "phoenhex team": "https://phoenhex.re/feed.xml", "Google Project Zero": "https://googleprojectzero.blogspot.com/feeds/posts/default", "SpecterOps Blog": "https://specterops.io/blog/", "Hack The Box - Red Teaming": "https://www.hackthebox.com/rss/blog/red-teaming", - "Code White": "https://code-white.com/rss/", "TrustedSec Blog": "https://www.trustedsec.com/feed/", - "Outflank Blog": "https://outflank.nl/blog/feed/", "Pentest Partners Blog": "https://www.pentestpartners.com/feed/", "Black Hills InfoSec Blog": "https://www.blackhillsinfosec.com/blog/feed/", "xpnsec Blog": "https://blog.xpnsec.com/rss/" diff --git a/feeds/threat_intel_feeds.json b/feeds/threat_intel_feeds.json index 0e88f16..c440893 100644 --- a/feeds/threat_intel_feeds.json +++ b/feeds/threat_intel_feeds.json @@ -1,5 +1,8 @@ { "threat_intel": { + "CISA Advisories": "https://www.cisa.gov/cybersecurity-advisories/all.xml", + "CISA Alerts": "https://www.cisa.gov/cybersecurity-advisories/alerts.xml", + "CISA ICS Advisories": "https://www.cisa.gov/cybersecurity-advisories/ics-advisories.xml", "SANS Internet Storm Center": "https://isc.sans.edu/rssfeed.xml", "Vulnerability Lab": "https://www.vulnerability-lab.com/rss/rss.php", "Proofpoint Threat Insight": "https://www.proofpoint.com/us/rss.xml", diff --git a/rss_manager.py b/rss_manager.py index d6039ef..636282a 100644 --- a/rss_manager.py +++ b/rss_manager.py @@ -219,12 +219,12 @@ class RSSFeedManager: 'canonical_url': canonical_url, } - def is_article_from_today(self, published_dt: datetime) -> bool: - """Allow only items published on today's UTC date.""" - now_utc = datetime.now(timezone.utc).date() + def is_article_recent(self, published_dt: datetime) -> bool: + """Allow articles published within the last 48 hours.""" if published_dt.tzinfo is None: published_dt = published_dt.replace(tzinfo=timezone.utc) - return published_dt.astimezone(timezone.utc).date() == now_utc + age = datetime.now(timezone.utc) - published_dt.astimezone(timezone.utc) + return age.total_seconds() <= 48 * 3600 def is_duplicate_article(self, article: Dict) -> bool: """Check URL/content fingerprint duplicates against sent-history.""" @@ -309,7 +309,7 @@ class RSSFeedManager: published_dt = datetime(*published[:6], tzinfo=timezone.utc) # Strict real-time gate: today's UTC articles only. - if not self.is_article_from_today(published_dt): + if not self.is_article_recent(published_dt): continue # Get content/description