{"status":"ok","api_version":"1.0","data":{"attribution":{"policy":"Every ingested source is attributed. Attribution is provenance, not endorsement. Sources listed with ingested=false are declared and deliberately not used.","stored":true,"sources":[{"source_key":"capec","name":"CAPEC","provider":"MITRE","homepage":"https://capec.mitre.org/","licence":"CAPEC is published by MITRE for public use with attribution","licence_url":"https://capec.mitre.org/about/termsofuse.html","terms_url":"https://capec.mitre.org/about/termsofuse.html","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CAPEC (MITRE).","tier":4,"notes":"INGESTED as a KNOWLEDGE BASE, not a feed: it publishes no observations. It supplies the CWE-to-technique route, the only published bridge from a weakness to an attack pattern: CWE -> CAPEC -> ATT&CK technique. Measured live: the catalogue holds 615 patterns, 450 of them carrying a CWE, which is 1,212 links across 336 distinct CWEs; the ATT&CK bundle references 32 CAPEC patterns covering 36 techniques; so 31 of 336 CWEs reach a technique. Against this pipeline's own output the route carries 328 threats and 721 routes, taking ATT&CK enrichment from 23 threats to 347. TWO HONEST CAVEATS. (1) All 36 techniques the route can reach are RETIRED by ATT&CK - they were revoked or merged after the CAPEC cross-reference was written - so every technique reached this way is published with retired true and a consumer can see it. (2) An earlier note in this repository claimed CAPEC's XML contains no ATT&CK identifiers at all. That was wrong: CAPEC carries 272 taxonomy mappings to ATT&CK, but they name only the taxonomy with no Entry_ID, so they identify no technique. The conclusion held; the wording did not, and the wording is what a reader would have trusted.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cert_eu_advisories","name":"CERT-EU Security Advisories","provider":"CERT-EU — Computer Emergency Response Team for the EU institutions, bodies and agencies","homepage":"https://www.cert.europa.eu/publications/security-advisories","licence":"CERT-EU legal notice — public advisories published for reuse with attribution","licence_url":"https://www.cert.europa.eu/legal-notice","terms_url":"https://www.cert.europa.eu/legal-notice","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CERT-EU security advisories (European Union).","tier":1,"notes":"The authoritative EU-level advisory stream. TLP-restricted items are rejected by the TLP gate, never republished.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cert_eu_threat_intel","name":"CERT-EU Threat Intelligence Reports","provider":"CERT-EU — Computer Emergency Response Team for the EU institutions, bodies and agencies","homepage":"https://www.cert.europa.eu/publications/threat-intelligence","licence":"CERT-EU legal notice — public reports published for reuse with attribution","licence_url":"https://www.cert.europa.eu/legal-notice","terms_url":"https://www.cert.europa.eu/legal-notice","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CERT-EU threat intelligence reports (European Union).","tier":1,"notes":"Analytical reporting on actors and campaigns affecting EU entities. TLP-restricted items are rejected.","updated_at":"2026-11-02 00:35:31"},{"source_key":"circl_misp_osint","name":"CIRCL MISP OSINT Feed","provider":"CIRCL (Computer Incident Response Center Luxembourg)","homepage":"https://www.circl.lu/doc/misp/feed-osint/","licence":"Community-contributed MISP event data, published by CIRCL as an open feed","licence_url":"https://www.circl.lu/","terms_url":"https://www.circl.lu/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CIRCL MISP OSINT feed.","tier":4,"notes":"INGESTED. A COMMUNITY feed: CIRCL publishes what its contributors share, so an event is evidence that someone reported a campaign, not a vendor assessment. It is ingested because it is the only source enabled today that cites ATT&CK technique identifiers, and without one the ATT&CK enrichment has nothing to resolve against. Its events carry tags of the form 'misp-galaxy:mitre-attack-pattern=\"Hooking - T1179\"', giving both the technique name and its identifier. Measured live: 1,681 events in the manifest, 123 carry a technique tag, 297 distinct technique identifiers across them, and a minority of events carry a restrictive traffic-light marking - so the marking is read PER EVENT and the gate applied to each, never inherited from the source. The manifest carries tags but not attributes, so techniques cost one request while CVEs and indicators cost one per event; event fetches are bounded per run and remembered in a cache. The wording above deliberately names no traffic-light level: the attribution register is published, and a published document that spells a restrictive marking out is refused by the quality gate - which is how this note was corrected.","updated_at":"2026-11-02 00:35:31"},{"source_key":"circl_vulnerability_lookup","name":"Vulnerability-Lookup","provider":"CIRCL — Computer Incident Response Center Luxembourg","homepage":"https://vulnerability.circl.lu/","licence":"Aggregated public vulnerability data; the Vulnerability-Lookup software is AGPL-3.0. Upstream sources (cvelistv5, NVD, GitHub advisories, CISA KEV) retain their own terms","licence_url":"https://www.gnu.org/licenses/agpl-3.0.html","terms_url":"https://vulnerability.circl.lu/documentation/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Vulnerability-Lookup, CIRCL (Computer Incident Response Center Luxembourg).","tier":1,"notes":"Provides sightings and bundles alongside aggregated vulnerability data, plus a documented incremental sync path. Respect the published rate-limit policy.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cisa_advisories","name":"CISA Cybersecurity Advisories","provider":"Cybersecurity and Infrastructure Security Agency (CISA), United States","homepage":"https://www.cisa.gov/news-events/cybersecurity-advisories","licence":"US Government work — not subject to copyright protection in the United States (17 U.S.C. §105)","licence_url":"https://www.cisa.gov/about/legal","terms_url":null,"tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CISA Cybersecurity Advisories (Cybersecurity and Infrastructure Security Agency).","tier":1,"notes":"SUPERSEDED by cisa_csaf and disabled. CISA's RSS endpoint answers HTTP 403 to server-side clients, and the same advisories are published as CSAF 2.0 documents in the cisagov/CSAF repository, which is machine-readable and carries its own TLP marking. Retained in the register so the attribution record stays complete.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cisa_csaf","name":"CISA CSAF Advisories (IT and OT)","provider":"Cybersecurity and Infrastructure Security Agency (CISA), United States","homepage":"https://github.com/cisagov/CSAF","licence":"US Government work — not subject to copyright protection in the United States (17 U.S.C. §105)","licence_url":"https://www.cisa.gov/about/legal","terms_url":"https://github.com/cisagov/CSAF","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CISA security advisories, CSAF 2.0 (Cybersecurity and Infrastructure Security Agency).","tier":1,"notes":"CSAF 2.0 documents for CISA's IT and OT advisories from the cisagov/CSAF repository, discovered through the standard changes.csv file. Each document states its own distribution.tlp.label, which the TLP gate enforces directly; the repository's white trees are TLP:WHITE, normalised to CLEAR.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cisa_kev","name":"CISA Known Exploited Vulnerabilities Catalog","provider":"Cybersecurity and Infrastructure Security Agency (CISA), United States","homepage":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","licence":"US Government work — not subject to copyright protection in the United States (17 U.S.C. §105)","licence_url":"https://www.cisa.gov/about/legal","terms_url":null,"tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CISA Known Exploited Vulnerabilities Catalog (Cybersecurity and Infrastructure Security Agency).","tier":1,"notes":"Authoritative catalogue of vulnerabilities known to be exploited in the wild. Public by design.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cisa_vulnrichment","name":"CISA Vulnrichment","provider":"Cybersecurity and Infrastructure Security Agency (CISA), United States","homepage":"https://github.com/cisagov/vulnrichment","licence":"US Government work — public domain (verify the repository licence at first ingest)","licence_url":"https://github.com/cisagov/vulnrichment","terms_url":null,"tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: CISA Vulnrichment (Cybersecurity and Infrastructure Security Agency).","tier":1,"notes":"Supplies SSVC decision points (Exploitation, Automatable, Technical Impact) and CISA-assigned CVSS. Used for the published decision field, never to overwrite exploitation evidence.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cisco_security_advisories","name":"Cisco Security Advisories","provider":"Cisco","homepage":"https://sec.cloudapps.cisco.com/security/center/publicationListing.x","licence":"Cisco publishes its security advisories publicly for the use of its customers and the wider community","licence_url":"https://www.cisco.com/c/en/us/about/legal/terms-conditions.html","terms_url":"https://www.cisco.com/c/en/us/about/legal/terms-conditions.html","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Cisco Security Advisories, Cisco.","tier":3,"notes":"INGESTED. Cisco's own advisory feed, carrying its severity rating, its fixed-software statement and the CVE list per advisory. Ordinary RSS, so it reuses the generic collector rather than getting one of its own. NOTE ON ENDPOINTS: the publicationService.x JSON API returns an empty body with a 200 status, which is indistinguishable from a working endpoint that has nothing to say, so it is not used; the psirtrss20 RSS feed was verified to return 148 KB with 50 items, 48 of which name a CVE.","updated_at":"2026-11-02 00:35:31"},{"source_key":"cwe","name":"Common Weakness Enumeration (CWE)","provider":"The MITRE Corporation","homepage":"https://cwe.mitre.org/","licence":"CWE is made available royalty-free by MITRE with attribution","licence_url":"https://cwe.mitre.org/about/termsofuse.html","terms_url":"https://cwe.mitre.org/about/termsofuse.html","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Common Weakness Enumeration (CWE™), The MITRE Corporation.","tier":4,"notes":"Weakness taxonomy used to explain what class of flaw a threat concerns. Knowledge mapping only.","updated_at":"2026-11-02 00:35:31"},{"source_key":"enisa_euvd","name":"European Union Vulnerability Database (EUVD)","provider":"European Union Agency for Cybersecurity (ENISA)","homepage":"https://euvd.enisa.europa.eu/","licence":"ENISA public vulnerability data — reuse permitted with attribution to ENISA","licence_url":"https://euvd.enisa.europa.eu/","terms_url":"https://www.enisa.europa.eu/legal-notice","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: European Union Vulnerability Database (EUVD), European Union Agency for Cybersecurity (ENISA).","tier":1,"notes":"The EU-authoritative vulnerability record: exploited flags, EPSS, vendor/product and EU advisory links. Re-verify ENISA reuse terms before commercial redistribution.","updated_at":"2026-11-02 00:35:31"},{"source_key":"epss_first","name":"Exploit Prediction Scoring System (EPSS)","provider":"FIRST — Forum of Incident Response and Security Teams","homepage":"https://www.first.org/epss/","licence":"Provided free of charge by FIRST for vulnerability prioritisation; attribution to FIRST and the EPSS model authors required","licence_url":"https://www.first.org/epss/","terms_url":"https://www.first.org/epss/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: EPSS (Exploit Prediction Scoring System), FIRST.","tier":1,"notes":"Probability that a CVE will be exploited in the next 30 days. A separate scoring dimension; it never overrides exploitation evidence.","updated_at":"2026-11-02 00:35:31"},{"source_key":"exploit_availability","name":"Public exploit availability signals","provider":"Offensive Security (Exploit-DB), ProjectDiscovery (Nuclei), Rapid7 (Metasploit), GitHub PoC repositories","homepage":"https://gitlab.com/exploit-database/exploitdb","licence":"Mixed: Exploit-DB is GPL-2.0, Nuclei templates are MIT, Metasploit is BSD-3-Clause, public PoC repositories vary per repository","licence_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/master/LICENSE.md","terms_url":null,"tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: public exploit-availability signals (Exploit-DB, Nuclei, Metasploit, public PoC repositories).","tier":1,"notes":"Used only as an availability signal that raises confidence. ThreatPulse never republishes exploit code or a working payload.","updated_at":"2026-11-02 00:35:31"},{"source_key":"feodo_tracker","name":"abuse.ch Feodo Tracker","provider":"abuse.ch (operated by Spamhaus Technology)","homepage":"https://feodotracker.abuse.ch/","licence":"abuse.ch Terms of Use; the public download endpoints require no Auth-Key and are subject to the abuse.ch Fair Use Policy","licence_url":"https://abuse.ch/","terms_url":"https://abuse.ch/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Feodo Tracker, abuse.ch.","tier":1,"notes":"INGESTED. CORRECTED 31 Oct 2026: this record previously stated that Feodo Tracker 'requires an Auth-Key'. It does not. Verified live: ipblocklist_aggressive.csv returns HTTP 200 with no key (623,072 bytes, 7,980 rows), and ipblocklist.json likewise (HTTP 200, no key). Both responses carry ETag and Last-Modified, so the collector uses a conditional request and an unchanged list costs one 304. Tier corrected from 2 (keyed) to 1 (open) because the download path is genuinely keyless; the abuse.ch Fair Use Policy still applies. Columns are first_seen_utc, dst_ip, dst_port, c2_status, last_online, malware, and there is NO CVE column, so like ThreatFox this is a malware-family-keyed source.","updated_at":"2026-11-02 00:35:31"},{"source_key":"fortinet_psirt","name":"Fortinet PSIRT Advisories","provider":"Fortinet","homepage":"https://www.fortiguard.com/psirt","licence":"Fortinet product security advisories, published openly for the use of Fortinet customers and the wider community","licence_url":"https://www.fortinet.com/corporate/about-us/legal","terms_url":"https://www.fortinet.com/corporate/about-us/legal","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Fortinet PSIRT, Fortinet.","tier":3,"notes":"INGESTED. A first-party vendor advisory feed: Fortinet states the affected products and versions, which a CVE record alone does not. Ingested through the generic RSS collector, so no collector was written for it. Verified reachable without a key: fortiguard.com/rss/ir.xml returns HTTP 200.","updated_at":"2026-11-02 00:35:31"},{"source_key":"misp_galaxy","name":"MISP Galaxy","provider":"MISP project","homepage":"https://www.misp-project.org/galaxy.html","licence":"MISP Galaxy cluster data — AGPL-3.0 project, reused with attribution","licence_url":"https://www.gnu.org/licenses/agpl-3.0.html","terms_url":"https://www.misp-project.org/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: MISP Galaxy (MISP project).","tier":4,"notes":"INGESTED as a KNOWLEDGE BASE, not a feed: it carries no observations and publishes nothing. It supplies an ALIAS BRIDGE to ATT&CK identifiers, so a malware family named by Feodo, ThreatFox or URLhaus still resolves when a feed spells the name differently from ATT&CK. Three of the forty galaxy files are fetched - mitre-enterprise-attack-malware, -tool and -intrusion-set - because measurement showed those are the only ones carrying meta.external_id, and every identifier in them is already in the ATT&CK index. They therefore add aliases and never new identifiers: 121 names ATT&CK does not carry, such as 'havex' for S0093, 'black energy' for S0089, 'schtasks.exe' for S0111 and 'cobalt gypsy' for G0059. The ransomware galaxy (2,179 values) and threat-actor galaxy (1,114 values) carry ZERO external_id values and cannot bridge to ATT&CK at all, so their 3.4 MB is deliberately not fetched. The gain is modest and is reported as modest.","updated_at":"2026-11-02 00:35:31"},{"source_key":"mitre_attack","name":"MITRE ATT&CK Enterprise","provider":"The MITRE Corporation","homepage":"https://attack.mitre.org/","licence":"MITRE ATT&CK is released under the MITRE ATT&CK terms of use; attribution to MITRE required","licence_url":"https://attack.mitre.org/resources/legal/","terms_url":"https://attack.mitre.org/resources/legal/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: MITRE ATT&CK® (The MITRE Corporation). ATT&CK is a registered trademark of The MITRE Corporation.","tier":1,"notes":"Technique, tactic, group and malware taxonomy used to map and explain, never as a scoring input.","updated_at":"2026-11-02 00:35:31"},{"source_key":"msrc","name":"Microsoft Security Update Guide","provider":"Microsoft","homepage":"https://msrc.microsoft.com/update-guide","licence":"Microsoft Security Update Guide data, published openly for Microsoft customers and the wider community","licence_url":"https://www.microsoft.com/en-us/legal/terms-of-use","terms_url":"https://www.microsoft.com/en-us/legal/terms-of-use","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Microsoft Security Update Guide, Microsoft.","tier":3,"notes":"INGESTED. Microsoft's FIRST-PARTY assessment of its own products, which no other source provides: its severity rating, its CVSS base score, the affected-product list, and the fixed build numbers an operator actually needs. A dependent per-CVE source, so it answers about the CVEs the pipeline already tracks and stays bounded per run. Uses the Security Update Guide OData API rather than CVRF: CVRF is XML and per-release, and the October 2026 document alone is 46.7 MB, whereas one CVE lookup here is about 1.5 KB. Verified live: the cveNumber filter returns the affected-product rows, an unknown CVE returns a count of 0 (a clean, cacheable miss), and $select is rejected with HTTP 403 so the payload cannot be trimmed server-side.","updated_at":"2026-11-02 00:35:31"},{"source_key":"national_cert_feeds","name":"European national CERT and CSIRT advisory feeds","provider":"Multiple national CERTs/CSIRTs (EU/EEA and partner states)","homepage":"https://github.com/pulsedive/certrss","licence":"Each national CERT publishes under its own government reuse terms; attribution to the individual CERT is required per item","licence_url":"https://github.com/pulsedive/certrss","terms_url":null,"tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: national CERT/CSIRT advisory feed (attributed per item to the publishing authority).","tier":1,"notes":"One collector, many feeds. Each feed carries its own attribution text; an item is attributed to its own national authority, never to ThreatPulse. Feeds that answer a browser challenge instead of a feed are excluded rather than retried: three were removed on 1 Nov 2026 because they rejected every automated request, with a browser User-Agent as well as ThreatPulse's own, so the block was not user-agent filtering and no plain HTTP client can read them. Retrying a challenge page only adds noise to the run report and traffic to a service that has asked to be left alone.","updated_at":"2026-11-02 00:35:31"},{"source_key":"ncsa_greece","name":"Εθνική Αρχή Κυβερνοασφάλειας (National Cyber Security Authority of Greece)","provider":"National Cyber Security Authority (NCSA), Hellenic Republic","homepage":"https://cyber.gov.gr/","licence":"Greek public authority publication — reuse with attribution to the National Cyber Security Authority","licence_url":"https://cyber.gov.gr/","terms_url":"https://cyber.gov.gr/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Εθνική Αρχή Κυβερνοασφάλειας / National Cyber Security Authority (Greece), cyber.gov.gr.","tier":1,"notes":"Greek-language national advisories and the weekly CVE digest. Original Greek text is stored verbatim; translations are never published.","updated_at":"2026-11-02 00:35:31"},{"source_key":"osv_dev","name":"OSV — Open Source Vulnerabilities","provider":"Google (OSV), aggregating ecosystem advisory databases","homepage":"https://osv.dev/","licence":"OSV data is provided under CC-BY-4.0; underlying advisories retain their own licences","licence_url":"https://osv.dev/docs/","terms_url":"https://osv.dev/docs/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: OSV — Open Source Vulnerabilities.","tier":1,"notes":"Package-ecosystem vulnerabilities relevant to supply-chain and Cyber Resilience Act exposure.","updated_at":"2026-11-02 00:35:31"},{"source_key":"ransomware_live","name":"Ransomware.live","provider":"Ransomware.live","homepage":"https://www.ransomware.live/","licence":"Data provided free of charge; attribution and a link to ransomware.live required","licence_url":"https://www.ransomware.live/","terms_url":"https://www.ransomware.live/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: ransomware.live (leak-site monitoring).","tier":1,"notes":"PRIVACY: victim organisation names are personal/organisational data and are never published as indicators. Only aggregate country and sector observations are used, to evidence regional relevance.","updated_at":"2026-11-02 00:35:31"},{"source_key":"redhat_security","name":"Red Hat Security Data API","provider":"Red Hat, Inc.","homepage":"https://access.redhat.com/security/data","licence":"Red Hat security data — reuse permitted with attribution to Red Hat","licence_url":"https://www.redhat.com/en/about/terms-use","terms_url":"https://www.redhat.com/en/about/terms-use","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Red Hat Security Data API (Red Hat, Inc.).","tier":1,"notes":"Enterprise Linux advisory and CPE data. Enterprise Linux is widely deployed in Greek and EU public-sector estates.","updated_at":"2026-11-02 00:35:31"},{"source_key":"sans_isc","name":"SANS Internet Storm Center / DShield","provider":"SANS Technology Institute — Internet Storm Center","homepage":"https://isc.sans.edu/","licence":"DShield data provided by the SANS Internet Storm Center for community use with attribution","licence_url":"https://isc.sans.edu/","terms_url":"https://isc.sans.edu/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: SANS Internet Storm Center / DShield.","tier":1,"notes":"Aggregated attack telemetry (top attacking networks and targeted ports). Used as contextual signal only.","updated_at":"2026-11-02 00:35:31"},{"source_key":"sigma","name":"Sigma","provider":"SigmaHQ","homepage":"https://github.com/SigmaHQ/sigma","licence":"Sigma rules are published under the Detection Rule License (DRL) 1.1","licence_url":"https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md","terms_url":"https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Sigma (SigmaHQ).","tier":4,"notes":"INGESTED as a KNOWLEDGE BASE, not a feed: it publishes no observations. It supplies DETECTION COVERAGE for a technique, which is what turns the ATT&CK context into something a defender can act on: a technique named beside a threat says what an adversary does, and a rule beside that technique says whether anyone has written a detection for it. Measured before building: the archive is 9.1 MB and holds 3,161 rule files, 2,817 of them carrying an attack.t tag, covering 390 distinct techniques through 3,819 rule-to-technique mappings. Of the 174 techniques this pipeline publishes, 128 have a rule and 46 do not - the 46 are as useful as the 128, because they are the techniques nothing detects yet. NO YAML PARSER IS USED: only the tags list entries and the title, level and status scalars are read, all line-oriented, so a malformed rule can at worst not appear. The regression_data tree is excluded deliberately - it holds info.yml files that sit under a rules path and look like rules but are test metadata, and the first file this parser read was one of them.","updated_at":"2026-11-02 00:35:31"},{"source_key":"sigma_rules","name":"SigmaHQ detection rules","provider":"SigmaHQ community project","homepage":"https://github.com/SigmaHQ/sigma","licence":"Detection Rule License (DRL) 1.1","licence_url":"https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md","terms_url":"https://github.com/SigmaHQ/sigma","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: SigmaHQ detection rules.","tier":4,"notes":"Used to map techniques to defensive guidance. Rule content is never republished in full.","updated_at":"2026-11-02 00:35:31"},{"source_key":"spamhaus_drop","name":"Spamhaus DROP list","provider":"The Spamhaus Project","homepage":"https://www.spamhaus.org/drop/","licence":"Free for use in security products and services with attribution to The Spamhaus Project; commercial redistribution requires a Spamhaus data licence","licence_url":"https://www.spamhaus.org/organization/terms-of-use/","terms_url":"https://www.spamhaus.org/organization/terms-of-use/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Spamhaus DROP list (The Spamhaus Project).","tier":1,"notes":"Hijacked and leased netblocks. Verify Spamhaus terms before any commercial redistribution.","updated_at":"2026-11-02 00:35:31"},{"source_key":"threatfox","name":"abuse.ch ThreatFox","provider":"abuse.ch (operated by Spamhaus Technology)","homepage":"https://threatfox.abuse.ch/","licence":"abuse.ch Terms of Use; the API requires a free Auth-Key and is subject to the Fair Use Policy","licence_url":"https://abuse.ch/","terms_url":"https://abuse.ch/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: ThreatFox, abuse.ch.","tier":2,"notes":"INGESTED. CORRECTED 31 Oct 2026: this record previously described ThreatFox as 'the strongest free CVE-to-IOC bridge'. That is wrong and was verified against the live API documentation. The documented get_iocs response fields are id, ioc, threat_type, threat_type_desc, ioc_type, ioc_type_desc, malware, malware_printable, malware_alias, malware_malpedia, confidence_level, first_seen, last_seen, reporter, reference and tags. There is NO cve field, and the query and submission documentation never mentions CVEs. ThreatFox is MALWARE-FAMILY-keyed. Its value to ThreatPulse is malware family to indicator, which reaches vulnerabilities only indirectly (family to ATT&CK software to technique) and never family to CVE. The Auth-Key travels as an HTTP header, never in a URL, so it is redaction-safe by construction; the rolling get_iocs window is bounded to 7 days upstream and accumulated in state.","updated_at":"2026-11-02 00:35:31"},{"source_key":"ubuntu_security","name":"Ubuntu Security Notices","provider":"Canonical","homepage":"https://ubuntu.com/security/notices","licence":"Canonical publishes its security notices publicly for the use of its users and the wider community","licence_url":"https://ubuntu.com/legal","terms_url":"https://ubuntu.com/legal","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: Ubuntu Security Notices, Canonical.","tier":3,"notes":"INGESTED. Canonical states which of its releases a CVE affects and which packages fix it, which no upstream CVE record says. One request per run: the notices list carries the CVEs each notice addresses, so no detail fetch is needed. Ubuntu offers no per-CVE lookup - /security/CVE-2021-44228.json returns 404 for a CVE that certainly exists - so the dependent lookup pattern Red Hat and MSRC use is not available here. Both facts were checked before the collector was written.","updated_at":"2026-11-02 00:35:31"},{"source_key":"urlhaus","name":"abuse.ch URLhaus","provider":"abuse.ch (operated by Spamhaus Technology)","homepage":"https://urlhaus.abuse.ch/","licence":"abuse.ch Terms of Use; download access requires a free Auth-Key and is subject to the abuse.ch Fair Use Policy","licence_url":"https://abuse.ch/","terms_url":"https://abuse.ch/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: URLhaus, abuse.ch.","tier":2,"notes":"INGESTED. abuse.ch requires an Auth-Key for every URLhaus API call and applies Fair Use rate limits. The key travels in the Auth-Key REQUEST HEADER, per abuse.ch's documented scheme, so it never appears in a URL, a log line, an exception message or a state file. CORRECTED 1 Nov 2026, after two successive attempts used the wrong download shape. The first (urlhaus.abuse.ch/downloads/json_recent/) was RETIRED by abuse.ch and answers HTTP 410 Gone. The second (urlhaus-api.abuse.ch/v2/files/exports/<key>/recent.json) does not exist either: its path root answers HTTP 404, and the run resolved it to a body larger than 64 MB instead of the recent-URL list, so every run failed with 'refusing to buffer it'. The endpoint is the documented GET https://urlhaus-api.abuse.ch/v1/urls/recent/, which returns the additions of the past three days capped at 1000 entries; that window is accumulated across runs, so coverage builds up rather than arriving at once. Probing the documented path without a key returns 401 Unauthorized, which confirms it exists and that only the credential was missing. abuse.ch asks that the service is not polled more than once every five minutes and now enforces Fair Use rate limits, so the daily schedule is well inside policy.","updated_at":"2026-11-02 00:35:31"},{"source_key":"vendor_advisories","name":"Vendor security advisories (generic collector)","provider":"Multiple vendors, including Microsoft, Cisco, Fortinet, Ivanti, Oracle, Adobe, Atlassian, GitLab, SAP, Apache, VMware, JetBrains, WordPress and Linux distributions","homepage":"https://msrc.microsoft.com/update-guide","licence":"Each vendor publishes under its own advisory terms; attribution to the publishing vendor is required per item","licence_url":"https://www.microsoft.com/en-us/legal/intellectualproperty/copyright","terms_url":null,"tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: vendor security advisory (attributed per item to the publishing vendor).","tier":3,"notes":"One generic collector reading a configured vendor list, rather than one bespoke collector per vendor. Each item is attributed to its own vendor.","updated_at":"2026-11-02 00:35:31"},{"source_key":"wordpress_security","name":"WordPress Security Releases","provider":"WordPress (WordPress Foundation)","homepage":"https://wordpress.org/news/category/security/","licence":"WordPress security announcements, published openly","licence_url":"https://wordpress.org/about/license/","terms_url":"https://wordpress.org/about/","tlp_default":"CLEAR","ingested":true,"attribution_text":"Source: WordPress Security Releases, WordPress Foundation.","tier":3,"notes":"INGESTED. Note the nature of this feed: it announces WordPress core and plugin security releases rather than publishing CVE records, so it contributes narrative context and advisory evidence more often than it contributes a scored vulnerability. Ingested through the generic RSS collector. Verified reachable without a key: wordpress.org/news/category/security/feed/ returns HTTP 200.","updated_at":"2026-11-02 00:35:31"},{"source_key":"nvd","name":"NIST National Vulnerability Database (NVD)","provider":"National Institute of Standards and Technology (NIST), United States","homepage":"https://nvd.nist.gov/","licence":"US Government work — public domain; API access is rate-limited and an API key is recommended","licence_url":"https://www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-data-software-and-technical-series-publications","terms_url":"https://nvd.nist.gov/developers/terms-of-use","tlp_default":"CLEAR","ingested":false,"attribution_text":"Source: NIST National Vulnerability Database (NVD).","tier":2,"notes":"NOT INGESTED DIRECTLY. CVE, CVSS and CPE coverage is obtained through CIRCL Vulnerability-Lookup and ENISA EUVD instead, so no data gap arises. Recorded for attribution completeness.","updated_at":"2026-11-02 00:35:31"}]}},"pagination":{"limit":100,"offset":0,"returned":34,"total":34,"has_more":false},"timestamp":"2026-11-02T00:54:25+00:00"}