48h article window, add CISA feeds, remove dead feeds

feeds/news_feeds.json

@@ -13,7 +13,6 @@
     "Cyber Security Hub": "https://www.cshub.com/rss-feeds",
     "PortSwigger Daily Swig": "https://portswigger.net/daily-swig/rss",
     "Qualys": "https://blog.qualys.com/feed",
-    "Rapid7": "https://blog.rapid7.com/feed",
     "0x44 Security Blog": "https://0x44.cc/feed.xml",
     "NCSC UK Blog": "https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml",
     "FBI Cyber Feeds": "https://www.fbi.gov/feeds"

feeds/research_feeds.json

@@ -14,15 +14,12 @@
     "Check Point Research": "https://research.checkpoint.com/feed/",
     "RET2 Systems Blog": "https://blog.ret2.io/feed.xml",
     "secret club": "https://secret.club/feed.xml",
-    "j00ru vx tech": "https://j00ru.vexillium.org/feed/",
     "Connor McGarr": "https://connormcgarr.github.io/feed.xml",
     "phoenhex team": "https://phoenhex.re/feed.xml",
     "Google Project Zero": "https://googleprojectzero.blogspot.com/feeds/posts/default",
     "SpecterOps Blog": "https://specterops.io/blog/",
     "Hack The Box - Red Teaming": "https://www.hackthebox.com/rss/blog/red-teaming",
-    "Code White": "https://code-white.com/rss/",
     "TrustedSec Blog": "https://www.trustedsec.com/feed/",
-    "Outflank Blog": "https://outflank.nl/blog/feed/",
     "Pentest Partners Blog": "https://www.pentestpartners.com/feed/",
     "Black Hills InfoSec Blog": "https://www.blackhillsinfosec.com/blog/feed/",
     "xpnsec Blog": "https://blog.xpnsec.com/rss/"

feeds/threat_intel_feeds.json

@@ -1,5 +1,8 @@
 {
   "threat_intel": {
+    "CISA Advisories": "https://www.cisa.gov/cybersecurity-advisories/all.xml",
+    "CISA Alerts": "https://www.cisa.gov/cybersecurity-advisories/alerts.xml",
+    "CISA ICS Advisories": "https://www.cisa.gov/cybersecurity-advisories/ics-advisories.xml",
     "SANS Internet Storm Center": "https://isc.sans.edu/rssfeed.xml",
     "Vulnerability Lab": "https://www.vulnerability-lab.com/rss/rss.php",
     "Proofpoint Threat Insight": "https://www.proofpoint.com/us/rss.xml",

rss_manager.py

@@ -219,12 +219,12 @@ class RSSFeedManager:
             'canonical_url': canonical_url,
         }
 
-    def is_article_from_today(self, published_dt: datetime) -> bool:
-        """Allow only items published on today's UTC date."""
-        now_utc = datetime.now(timezone.utc).date()
+    def is_article_recent(self, published_dt: datetime) -> bool:
+        """Allow articles published within the last 48 hours."""
         if published_dt.tzinfo is None:
             published_dt = published_dt.replace(tzinfo=timezone.utc)
-        return published_dt.astimezone(timezone.utc).date() == now_utc
+        age = datetime.now(timezone.utc) - published_dt.astimezone(timezone.utc)
+        return age.total_seconds() <= 48 * 3600
 
     def is_duplicate_article(self, article: Dict) -> bool:
         """Check URL/content fingerprint duplicates against sent-history."""
@@ -309,7 +309,7 @@ class RSSFeedManager:
                         published_dt = datetime(*published[:6], tzinfo=timezone.utc)
 
                         # Strict real-time gate: today's UTC articles only.
-                        if not self.is_article_from_today(published_dt):
+                        if not self.is_article_recent(published_dt):
                             continue
 
                         # Get content/description