SecureNewspaper/config.yaml at main · mfksec/SecureNewspaper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
schedule:
  cron: "0 9 * * 1-5"          # Every weekday at 09:00
  timezone: "Europe/Berlin"
  lookback_hours: 24           # Fetch articles from last 24 hours
  max_items_per_section: 5     # Max articles per section in gazette

slack:
  webhook_url: "${SLACK_WEBHOOK_URL}"  # export SLACK_WEBHOOK_URL=https://hooks.slack.com/...
  newspaper_name: "The Security Gazette"
  show_sources_count: true

sources:
  - name: "CISA Alerts"
    url: "https://www.cisa.gov/cybersecurity-advisories/all.xml"
    enabled: true
    weight: 1

  - name: "Krebs on Security"
    url: "https://krebsonsecurity.com/feed"
    enabled: true
    weight: 1

  - name: "SANS ISC"
    url: "https://isc.sans.edu/dailypodcast.xml"
    enabled: true
    weight: 1

  - name: "Dark Reading"
    url: "https://www.darkreading.com/rss.xml"
    enabled: true
    weight: 1

  - name: "Recorded Future"
    url: "https://www.recordedfuture.com/feed/"
    enabled: true
    weight: 1

  - name: "TechCrunch Security"
    url: "https://techcrunch.com/category/security/feed/"
    enabled: true
    weight: 1

  - name: "Ars Technica"
    url: "https://feeds.arstechnica.com/arstechnica/index"
    enabled: true
    weight: 1

  - name: "Microsoft Security Blog"
    url: "https://www.microsoft.com/en-us/security/blog/feed/"
    enabled: true
    weight: 1

  - name: "CrowdStrike Blog"
    url: "https://www.crowdstrike.com/blog/feed/"
    enabled: true
    weight: 1

  - name: "Bleeping Computer"
    url: "https://www.bleepingcomputer.com/feed/"
    enabled: true
    weight: 1

  - name: "Threatpost"
    url: "https://threatpost.com/feed/"
    enabled: true
    weight: 1

  - name: "Help Net Security"
    url: "https://www.helpnetsecurity.com/feed/"
    enabled: true
    weight: 1

  - name: "CSO Online"
    url: "https://www.csoonline.com/feed/"
    enabled: true
    weight: 1

sections:
  THREAT_INTELLIGENCE:
    emoji: "⚠️"
    keywords: ["APT", "threat actor", "TA\\d+", "state-sponsored", "campaign", "malicious", "threat"]

  VULNERABILITIES:
    emoji: "🐛"
    keywords: ["CVE-", "vulnerability", "0-day", "zero-day", "exploit", "patch", "flaw"]

  BREACHES:
    emoji: "🚨"
    keywords: ["breach", "data leak", "leaked", "compromise", "unauthorized access", "incident"]

  RANSOMWARE:
    emoji: "💀"
    keywords: ["ransomware", "malware", "worm", "trojan", "encrypted", "attack"]

  INDUSTRY_POLICY:
    emoji: "🏛️"
    keywords: ["regulation", "policy", "compliance", "GDPR", "HIPAA", "law", "government"]

  TOOLS_TECHNIQUES:
    emoji: "🔧"
    keywords: ["tool", "technique", "framework", "methodology", "defense", "detection"]

  ADVISORIES:
    emoji: "📢"
    keywords: ["advisory", "alert", "warning", "notice", "recommend", "security bulletin"]