bot
63f0ac74bc
Category labels, feed-file mappings, and emoji were copy-pasted across threat_intel_bot.py, check_feeds.py, and validation/run_validation.py, which is how the ransomware category split almost missed one of them. check_feeds.py now imports from bot_config.py instead of keeping its own copy. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
53 lines
1.9 KiB
Python
53 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Shared category, feed-file, and tuning configuration.
|
|
|
|
Single source of truth for values that used to be copy-pasted across
|
|
threat_intel_bot.py, check_feeds.py, and validation/run_validation.py —
|
|
edit here, not in the callers.
|
|
"""
|
|
|
|
# category -> (display label, emoji)
|
|
CATEGORY_LABELS = {
|
|
"news": ("News", "📰"),
|
|
"malware": ("Malware", "🦠"),
|
|
"threat_intel": ("Threat Intel", "🛰️"),
|
|
"osint": ("OSINT", "🕵️"),
|
|
"research": ("Research", "🔬"),
|
|
}
|
|
|
|
# category -> RSS feed list file. Every key here must also be in CATEGORY_LABELS.
|
|
CATEGORY_FEEDS = {
|
|
"news": "feeds/news_feeds.json",
|
|
"malware": "feeds/malware_feeds.json",
|
|
"threat_intel": "feeds/threat_intel_feeds.json",
|
|
"osint": "feeds/osint_feeds.json",
|
|
"research": "feeds/research_feeds.json",
|
|
}
|
|
|
|
# Categories with no RSS feed of their own (e.g. fed by an API poller instead).
|
|
# Subscribable via /on_<category>, but excluded from the RSS polling/status loops.
|
|
EXTRA_CATEGORY_LABELS = {
|
|
"ransomware": ("Ransomware", "💰"),
|
|
}
|
|
|
|
CATEGORY_EMOJIS = {
|
|
key: emoji for key, (_label, emoji) in {**CATEGORY_LABELS, **EXTRA_CATEGORY_LABELS}.items()
|
|
}
|
|
|
|
# How often the bot/validation monitor polls feeds and the ransomware.live API.
|
|
POLL_INTERVAL_SECONDS = 300
|
|
|
|
# How long "seen" fingerprints and recently-sent titles are kept for dedup.
|
|
# Only used to suppress re-alerting on the same story — no other retention need.
|
|
SEEN_RETENTION_DAYS = 14
|
|
|
|
# Only alert on ransomware.live victims headquartered in these ISO-2 countries.
|
|
# The general global feed is available directly on ransomware.live's own site.
|
|
ALLOWED_RANSOMWARE_COUNTRIES = {"LV", "EE", "LT"}
|
|
|
|
# Cross-source near-duplicate title matching (catches the same story reported
|
|
# by two different outlets with different URLs/wording).
|
|
TITLE_DEDUP_WINDOW_HOURS = 72
|
|
TITLE_SIMILARITY_THRESHOLD = 0.72
|