About ThreatFilter

What it is

ThreatFilter aggregates public cyber threat intelligence — vulnerability advisories, exploitation reports, and security news — from 52 enabled sources, updated hourly. Pick the vendors in your stack and the regions you care about; the feed filters to just what's relevant.

How it works

A scheduled ingest worker fetches each source's RSS / JSON feed every hour and dedupes against prior items, so the feed itself is fresh and complete. The filter UI is a thin client over a small public API. No login is required to read or filter.

Classification is currently heuristic. The dedicated ML classifier (vendor / severity / exploitation / region tagging) is not yet running, so those tags are derived in your browser by matching each item's title and summary against a 349-vendor alias catalog with conservative, word-boundary keyword rules. It is deliberately strict to avoid false matches, but it is a strong hint rather than ground truth — always open the linked source to confirm. Vendor tile counts reflect the most recent window of items rather than all-time history.

Data sources

Public, authoritative feeds only — CISA KEV, NVD, vendor PSIRTs (Palo Alto, Fortinet, Cisco, Juniper, Microsoft, VMware, and more), regional CERTs (CISA, ENISA, NCSC, JPCERT, TWCERT, CCCS, ACSC, KrCERT, CERT.br, CERT-In), and leading independent threat-intel publications. The full list and live fetch status is on the sources page.

The registry lists 58 sources in all; 52 are currently enabled and polled hourly, and 50 are available as one-click RSS/Atom subscriptions through the OPML export.

Daily digest

Opt-in via the digest page. You confirm your address, and once email delivery is live you'll get one short message per day at 07:00 UTC summarising the high-severity items for your saved vendor + region filter — nothing on quiet days, one-click unsubscribe in every message. Email sending is being finalised, so subscriptions are saved but delivery hasn't started yet; the RSS feed (which accepts a ?v= stack filter) needs no signup in the meantime.

Filters, shareable links & RSS

Filter state is captured in the URL (?v=&sev=&ex=&geo=&q=) so any filtered view can be bookmarked or shared. The same state is mirrored to localStorage so a return visit restores your last filter automatically. Any vendor selection also produces a matching RSS feed at /feed.xml?v=… (alias /rss.xml) — a personalized, no-signup feed you can drop into any reader.

Privacy

No tracking pixels, no analytics, no third-party scripts. Email addresses entered for the digest are used solely to send the digest, are never shared, and are removed on unsubscribe.

Operated by

ThreatFilter is an independent project, built and kept current with heavy automation rather than a newsroom. The aggregation, tagging and tool datasets described above are generated from public feeds and open datasets, and the source registry and public API keep the inputs auditable rather than asking you to take the output on trust. There is no tracking and no account, and the heuristic-classification caveats above apply — always confirm against the linked primary source.